The FWDesign Ultimate Video Player up to version 10.1 contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2025-49430. SSRF vulnerabilities allow attackers to make the vulnerable server perform HTTP requests to arbitrary domains, which can lead to unauthorized information disclosure or manipulation of internal resources. The CVSS score of 7.2 reflects a high-severity issue exploitable remotely without authentication or user interaction. No patch or official remediation details are currently provided, and no known exploits have been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the server hosting Ultimate Video Player to send crafted requests to internal or external systems, potentially leading to partial confidentiality and integrity impacts. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.