Home

Description

Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.

PUBLISHED Reserved 2025-12-27 | Published 2025-12-30 | Updated 2026-02-20 | Assigner VulnCheck




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem types

URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status
unaffected

1.6
affected

1.0.0.15
affected

Credits

Mencha Isajlovska of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5928.php exploit

www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5928.php (Zero Science Lab Disclosure (ZSL-2025-5928)) third-party-advisory

packetstorm.news/files/id/190179/ (Packet Storm Security Exploit Entry) exploit

www.kseniasecurity.com/ (Ksenia Security Vendor Homepage) product

www.vulncheck.com/...utomation-url-redirection-vulnerability third-party-advisory

cve.org (CVE-2025-15112)

nvd.nist.gov (CVE-2025-15112)

Download JSON