This vulnerability (CVE-2025-60175) is a CWE-918 SSRF issue in vynnus PopAd affecting versions up to 1.0.4. It enables an administrator to cause the server to perform unintended requests, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and a scope change. No patch or official remediation level has been published, and no exploits are known in the wild.

The vulnerability allows an administrator to perform SSRF attacks, which may lead to limited confidentiality and integrity impacts on the affected system. There is no impact on availability. The medium CVSS score reflects the need for administrator privileges and high attack complexity, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict administrator access and review server request handling configurations to limit SSRF risks.