CVE-2025-5260

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery.

This issue affects Pik Online: before 3.1.5.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-526007.2Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discCVE-2025-526017.8Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discCVE-2025-526024.2HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.  An HTTP GET endpoint request returns disCVE-2025-526033.5HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limCVE-2025-526064.3HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural securityCVE-2025-526084.3HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookCVE-2025-526095.3HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-CVE-2025-52617.5Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of TrusteCVE-2025-526114.3HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined propertCVE-2025-526128.8HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. TCVE-2025-526138.8HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI serCVE-2025-526144.3HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by f
CVE-2025-5260: High severity, CVSS 8.6 | Vulnix