CVE-2025-12140 - CVE House
Back to Database
Status published Critical CVE-2025-12140

RCE in Wirtualna Uczelnia

Vulnerability Description

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12140

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Marcin Ressel

References

More from Simple SA

View All →
CVE-2025-9339
SQL Injection in SIMPLE.ERP
High 7.1
CVE-2024-8774
Privilege Escalation in SIMPLE.ERP
High 7.7
CVE-2024-8773
Protocol Downgrade in SIMPLE.ERP
High 8.3

Affected Vendor

Affected Software

Wirtualna Uczelnia
Vulnerable Versions:
0

Timeline

Official Publish: November 27th, 2025
Last Modified: November 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.