CVE-2025-10695

CVE-2025-10695CVE-2025-10695

opensupports / opensupports

Description

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects OpenSupports: 4.11.0.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Last modified2026-10-19
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.