PT-2025-30326 · Eveo · Eveo Urve Web Manager

Stefan Krause · Published 2025-07-21 · Updated 2026-01-16 · CVE-2025-36845

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eveo URVE Web Manager version 27.02.2025

Description An issue exists in Eveo URVE Web Manager that allows for Server-Side Request Forgery (SSRF). The / internal/redirect.php endpoint accepts a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only accessible by the application server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-36845

Affected Products

Eveo Urve Web Manager

References · 11

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-36845 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36845 · Vendor Advisory
• https://t.me/cvenotify/129718 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947379296793702740 · Twitter Post
• https://twitter.com/CVEnew/status/1947361904969601530 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2012087463565840795 · Twitter Post
• https://t.me/cvenotify/129719 · Telegram Post
• https://t.me/cveNotify/135317 · Telegram Post
• https://smartoffice.expert/en · Note
• https://t.me/cveNotify/135316 · Telegram Post