CVE-2025-12250

MediumCVSS 4.7

Published: 27/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

42th percentile - higher than 42% of all known CVEs

Summary

A flaw was found in OpenWGA 7.11.12 Build 737. An unknown function of the WGA.File file in the TMLScript API component is affected. Manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early but did not respond.

Risk Assessment

An attacker could remotely read arbitrary files on the server, potentially leading to leakage of sensitive information such as configuration data or passwords.

Recommendation

Apply available workarounds or mitigations since the vendor has not provided a patch. Consider restricting access to the application and monitoring for unusual requests.

Other vulnerabilities in OpenWGA

CVE-2025-12251Low
A cross-site scripting vulnerability was found in an unknown function of the Admin UI component in OpenWGA 7.11.12 Build 737. The attack can be initiated remotely and the exploit has been publicly disclosed.

Original NVD description (English source)

A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS