PT-2025-48268 · Unknown · Wirtualna Uczelnia

Marcin Ressel · Published 2025-11-27 · Updated 2025-11-27 · CVE-2025-12140

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu#2016.1.5513#0#20251014 113353

Description The application has an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, potentially allowing an unauthenticated attacker to execute arbitrary code. The vulnerable component is the processing of the redirectUrlParameter parameter within the 'redirectToUrl' mechanism.

Recommendations Update Wirtualna Uczelnia to version wu#2016.1.5513#0#20251014 113353 or later.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-12140

Affected Products

Wirtualna Uczelnia

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12140 · Security Note
• https://t.me/CVEtracker/38390 · Telegram Post
• https://twitter.com/CVEnew/status/1994053245556117718 · Twitter Post
• https://twitter.com/0dayPublishing/status/1994046071723487375 · Twitter Post
• https://t.me/cveNotify/144187 · Telegram Post
• https://cert.pl/posts/2025/11/CVE-2025-12140 · Note
• https://twitter.com/lowcountrycyber/status/1994123037243826629 · Twitter Post