CVE-2025-28091 Server-side request forgery in n/a

Critical 9.1 Published 28 Mar 2025 Updated 31 Mar 2025

An attacker can exploit an SSRF vulnerability in Maccms10 via the Add Article feature to access internal resources or bypass security controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-28091?

CVE-2025-28091 is a critical server-side request forgery vulnerability in n/a, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.

Weakness: CWE-918

Which versions are affected by CVE-2025-28091?

It affects 1 product.

Products include Maccms Maccms.

How do I fix CVE-2025-28091?

No fix has been published for CVE-2025-28091 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-28091 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28091 exists.

Sources

Also known as GHSA-rwcm-vvj8-qgg5.