CVE-2025-25785 identifies an SSRF vulnerability in JizhiCMS v2.5.4 within the \c\PluginsController.php file. An attacker can exploit this vulnerability by crafting specific requests that cause the server to make unintended requests to internal network resources, effectively enabling intranet scanning. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 9.1, reflecting high confidentiality and integrity impact. No official patch or remediation guidance has been published as of the data provided.

Successful exploitation allows an unauthenticated remote attacker to perform server-side requests to internal network resources, potentially revealing sensitive information about the internal network topology and services. This compromises confidentiality and integrity but does not directly impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable component and monitor for suspicious requests that may indicate exploitation attempts.