CVE-2025-30164

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-301658.0vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for CVE-2025-301664.8Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending func CVE-2025-301677.3Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, CVE-2025-301686.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd pa CVE-2025-301696.7File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This i CVE-2025-30175.3A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of t CVE-2025-301705.5Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session CVE-2025-301719.0System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become c CVE-2025-301728.0Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPEC CVE-2025-301736.7File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterpri CVE-2025-301747.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V CVE-2025-301757.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V