CVE-2025-3027

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-302706.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accountCVE-2025-302716.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accountCVE-2025-302726.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerCVE-2025-302738.1An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user aCVE-2025-302746.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerCVE-2025-302756.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-302768.8An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then expCVE-2025-302778.8An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they CVE-2025-302788.8An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they CVE-2025-302798.8An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, theCVE-2025-30286.5JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed inCVE-2025-302805.3A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix Runtime V10.12 (All versions < V10.12.16), Mendi
CVE-2025-3027: Medium severity, CVSS 6.1 | Vulnix