Insecure Redirect Vulnerability in Software Product from Vendor
CVE-2025-12140

9.3CRITICAL

Key Information:

Vendor

Simple Sa

Status
Wirtualna Uczelnia
Vendor
CVE Published:
27 November 2025

What is CVE-2025-12140?

The application contains a serious flaw in its 'redirectToUrl' mechanism, where it improperly handles the 'redirectUrlParameter'. This vulnerability permits an unauthenticated attacker to exploit the system by injecting a malicious string that is interpreted as a Java expression, leading to arbitrary code execution. An update has been released to remediate this issue in version wu#2016.1.5513#0#20251014_113353.

Affected Version(s)

Wirtualna Uczelnia 0

References

https://cert.pl/posts/2025/11/CVE-2025-12140/

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Ressel
.