CVE-2025-13796 MEDIUM

CVE-2025-13796: deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery

Vendor Deco-Cx
Product apps
Weakness CWE-918 · SSRF
Published November 30, 2025
Last update December 1, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.120.2 addresses this issue. It is suggested to upgrade the affected component.

Key dates

02Disclosure timeline

November 30, 2025 CVE published
December 1, 2025 Record updated