CVE-2025-28093: 
PHP vulnerability analysis and mitigation

ShopXO v6.4.0 contains a Server-Side Request Forgery (SSRF) vulnerability in its Email Settings functionality. The vulnerability was discovered and disclosed on March 28, 2025, and was assigned CVE-2025-28093. This security flaw affects the ShopXO e-commerce platform version 6.4.0 (NVD Database, MITRE CVE).

The vulnerability has been classified as a Server-Side Request Forgery (SSRF) issue, identified as CWE-918. According to the CVSS v3.1 scoring system, it has received a base score of 6.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. This indicates that the vulnerability requires low attack complexity and can be exploited remotely with low privileges and no user interaction (NVD Database).

The SSRF vulnerability in ShopXO's Email Settings could allow attackers to make unauthorized server-side requests, potentially leading to internal network scanning, data exfiltration, or interaction with internal services. The CVSS scoring indicates potential impacts on confidentiality, integrity, and availability, all rated as Low (NVD Database).