CVE-2025-63551: XEE
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path /admin/#/webset/?headtabactive=0, where user-provided XML data is processed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63551?
CVE-2025-63551 is considered a high-severity vulnerability because it enables Server-Side Request Forgery (SSRF) through XML External Entity (XXE) injection.
How do I fix CVE-2025-63551?
To fix CVE-2025-63551, upgrade the MetInfo Content Management System to a version beyond 8.1 where this vulnerability is patched.
What systems are affected by CVE-2025-63551?
CVE-2025-63551 affects the MetInfo Content Management System up to version 8.1.
What type of attack can be executed using CVE-2025-63551?
CVE-2025-63551 allows attackers to conduct Server-Side Request Forgery (SSRF) attacks through crafted XML payloads.
Is CVE-2025-63551 exploitable remotely?
Yes, CVE-2025-63551 is exploitable remotely, which means an attacker can exploit this vulnerability without direct access to the server.