CVE-2025-28090 Server-side request forgery in n/a

Critical 9.1 Published 28 Mar 2025 Updated 31 Mar 2025

An attacker can exploit SSRF in the Collection Custom Interface to access internal resources or bypass security controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-28090?

CVE-2025-28090 is a critical server-side request forgery vulnerability in n/a, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.

Weakness: CWE-918

Which versions are affected by CVE-2025-28090?

It affects 1 product.

Products include Maccms Maccms.

How do I fix CVE-2025-28090?

No fix has been published for CVE-2025-28090 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-28090 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28090 exists.

Sources

Also known as GHSA-7q69-vmcq-34w9.