This vulnerability (CVE-2025-60175) is classified as CWE-918, Server-Side Request Forgery (SSRF), in the vynnus PopAd product. It affects versions up to and including 1.0.4. The issue allows an attacker with administrator privileges to cause the server to make unintended requests, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and a scope change. The vulnerability is published but lacks an official fix or patch as of the current data.

The vulnerability could allow an attacker with administrator privileges to perform SSRF attacks, potentially leading to limited confidentiality and integrity impacts on the affected system. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, administrators should monitor vendor communications for updates. Restricting administrator access and limiting the server's ability to make arbitrary network requests may help reduce risk until a patch is released.