CVE-2025-7763

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-77649.8A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown functio CVE-2025-77659.8A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is a CVE-2025-77668.0Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to u CVE-2025-77675.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue CVE-2025-77689.3Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative acces CVE-2025-77698.7Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is cal CVE-2025-77708.7Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predicta CVE-2025-77718.7ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the Mm CVE-2025-77726.5The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all vers CVE-2025-77738.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an inte CVE-2025-77748.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a CVE-2025-77759.8Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScale