CVE-2025-50228

CriticalCVSS 9.1/10Last modified Oct 15, 2026

Description

Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Oct 15, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-502299.8Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.CVE-2025-50237.1Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versiCVE-2025-502336.5A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of tCVE-2025-502346.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter isCVE-2025-50247.4A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust sysCVE-2025-502409.8nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin.CVE-2025-50254.8libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when coCVE-2025-502519.1Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.CVE-2025-502557.8Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.CVE-2025-502588.1Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter.CVE-2025-502607.5Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function via the firewallEn parameter.CVE-2025-502627.5Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetQosBand function via the list parameter.