CVE-2025-4012

PlayEdu PlayEdu 开源培训系统 (playeduxyz) versions up to 1.8 contain a vulnerability in the User Avatar Handler’s /api/backend/v1/user/create endpoint. The issue arises from manipulating the Avatar argument, enabling server-side request forgery (SSRF). Attacks can be initiated remotely, and the exploit...