CVE-2025-12140 — RCE in Wirtualna Uczelnia

CVE-2025-12140

RCE in Wirtualna Uczelnia PUBLISHED

Description (CNA)

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353

Affected (CNA)

Vendor / product	Versions
Simple SA / Wirtualna Uczelnia	affected 0 before wu#2016.1.5513#0#20251014_113353

CWE

CWE-95

References

https://cert.pl/posts/2025/11/CVE-2025-12140/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.