Vulnerability Database

324,311

Total vulnerabilities in the database

CVE-2025-12107

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.

Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.

  • Published: Feb 19, 2026
  • Updated: Feb 20, 2026
  • CVE: CVE-2025-12107
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 10
  • AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWEs:

Software From Fixed in
wso2 / identity_server 5.11.0 5.11.0.x