CVE-2025-10695 — OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission =>…
Published: 2025-10-03 · CVSS: 6.9 · CVSS 4.0
Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7