← Vulnerability feed

Vulnerability record · CVE-2025-13871 · published 2 December 2025

CVE-2025-13871: Objectplanet opinio cross-site request forgery vulnerability

OObjectplanet · Opinio

Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

2.3 CVSS 4.0 Low EPSS 0.18% · top 93.0% CWE-352 · Cross-site request forgery
2.3CVSS 4.0 base score
0.18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
26 Sep 2026Last modified by NVD

Description

Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access such files without authentication.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.objectplanet.com/opinio/changelog.html Release Notes

Track CVE-2025-13871 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-4472Objectplanet opinio vulnerabilityObjectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which c…EPSS 0.74%8.8CVE-2020-26806Objectplanet opinio path traversal vulnerabilityadmin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because…EPSS 6.0%7.5CVE-2020-26565Objectplanet opinio expression language injection vulnerabilityObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve pos…EPSS 1.7%6.5CVE-2020-26564Objectplanet opinio xml external entity (xxe) vulnerabilityObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic sur…EPSS 1.1%6.1CVE-2020-26563Objectplanet opinio cross-site scripting vulnerabilityObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored X…EPSS 0.98%6.1CVE-2017-10798Objectplanet opinio cross-site scripting vulnerabilityIn ObjectPlanet Opinio before 7.6.4, there is XSS.EPSS 0.64%4.8CVE-2025-13873Objectplanet opinio cross-site scripting vulnerabilityStored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject a…EPSS 0.20%2.1CVE-2025-13872Objectplanet opinio server-side request forgery (ssrf) vulnerabilityBlind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker …EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2025-13871), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.