CVE-2025-10695

Two unauthenticated diagnostic endpoints in OpenSupports 4.11.0 allow arbitrary backend-initiated connections to an attacker-controlled destination, enabling unauthenticated SSRF for internal network scanning and service interaction. Affected product/version: OpenSupports 4.11.0. Root cause: endp...

CVE-2025-10695 OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission = 'any', enabling unauthenticated SSRF for internal network scanning and service interaction. This issue affects...