CVE-2025-30164

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

• CWE-601

• https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5Release Notes
• https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3Release Notes
• https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8qVendor Advisory

Published

Mar 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30159Kirby is an open-source content management system. A vulnera…9.1
• CVE-2025-3016A vulnerability classified as problematic was found in Open …6.5
• CVE-2025-30160Redlib is an alternative private front-end to Reddit. A vuln…7.5
• CVE-2025-30161OpenEMR is a free and open source electronic health records …5.4
• CVE-2025-30162Cilium is a networking, observability, and security solution…4.3
• CVE-2025-30163Cilium is a networking, observability, and security solution…4.7
• CVE-2025-30165vLLM is an inference and serving engine for large language m…8
• CVE-2025-30166Pimcore's Admin Classic Bundle provides a Backend UI for Pim…4.8
• CVE-2025-30167Jupyter Core is a package for the core common functionality …7.3
• CVE-2025-30168Parse Server is an open source backend that can be deployed …6.9
• CVE-2025-30169File upload and execute vulnerabilities in ASPECT allow PHP …6.7
• CVE-2025-3017A vulnerability, which was classified as critical, has been …5.3