CVE-2023-25262

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting Designer (Web) offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather than the client. Therefore, the server causes outbound traffic and potentially imports data. An attacker may also leverage this behaviour to exfiltrate data of machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).

• CWE-918
• CWE-918

• https://cloud-trustit.spp.at/s/HjEksN86SfsMaJMBroken Link
• https://cves.at/posts/cve-2023-25262/writeup/Exploit, Third Party Advisory
• https://cloud-trustit.spp.at/s/HjEksN86SfsMaJMBroken Link
• https://cves.at/posts/cve-2023-25262/writeup/Exploit, Third Party Advisory

Published

Mar 28, 2023

Last Modified

Jul 9, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2524A vulnerability classified as critical has been found in Con…9.8
• CVE-2023-25240An improper SameSite Attribute vulnerability in pimCore v10.…8.8
• CVE-2023-25241bgERP v22.31 was discovered to contain a reflected cross-sit…6.1
• CVE-2023-2526The Easy Google Maps plugin for WordPress is vulnerable to C…5.4
• CVE-2023-25260Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local Fi…7.5
• CVE-2023-25261Certain Stimulsoft GmbH products are affected by: Remote Cod…9.8
• CVE-2023-25263In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, onc…5.5
• CVE-2023-25264An issue was discovered in Docmosis Tornado prior to version…7.5
• CVE-2023-25265Docmosis Tornado <= 2.9.4 is vulnerable to Directory Travers…7.5
• CVE-2023-25266An issue was discovered in Docmosis Tornado prior to version…8.8
• CVE-2023-25267An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (…8.8
• CVE-2023-2527The Integration for Contact Form 7 and Zoho CRM, Bigin WordP…4.8