CVE-2025-11272: SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11272?
CVE-2025-11272 has a high severity due to the potential for improper authorization leading to impactful unauthorized actions.
How do I fix CVE-2025-11272?
To fix CVE-2025-11272, update your SeriaWei ZKEACMS to a version later than 4.3 that addresses this vulnerability.
What component is affected by CVE-2025-11272?
CVE-2025-11272 affects the POST Request Handler component, specifically the Delete function in UrlRedirectionController.cs.
Can CVE-2025-11272 be exploited remotely?
Yes, CVE-2025-11272 can be exploited remotely due to improper authorization in the affected component.
What version of SeriaWei ZKEACMS is vulnerable to CVE-2025-11272?
SeriaWei ZKEACMS versions up to and including 4.3 are vulnerable to CVE-2025-11272.