CVE-2025-50228 identifies a Server-Side Request Forgery (SSRF) vulnerability in Jizhicms v2.5.4 specifically within the User Evaluation, Message, and Comment modules. SSRF vulnerabilities allow attackers to make the server perform unintended requests, potentially accessing internal resources or sensitive data. The CVSS v3.1 base score of 9.1 reflects a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability is cataloged under CWE-918 (Server-Side Request Forgery). No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation of this SSRF vulnerability could allow attackers to access or manipulate sensitive information on internal or external systems accessible by the server, compromising confidentiality and integrity. The vulnerability does not impact availability. No known exploits have been reported, so active exploitation status is currently unknown.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting server outbound requests from the affected modules or applying network-level controls to limit SSRF attack surface. Avoid exposing vulnerable modules to untrusted users where possible.