CVE-2025-11190
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
Risk Assessment
Users can be redirected to malicious websites, potentially leading to phishing and credential theft.
Recommendation
Update Kiwire Captive Portal to the latest version and verify that the login-url parameter is properly validated.
Other vulnerabilities in Kiwire Captive Portal
See all- CVE-2025-11189High
Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability in the login-url parameter, allowing JavaScript execution.
- CVE-2025-11188High
Kiwire Captive Portal contains a blind SQL injection vulnerability in the nas-id parameter, allowing SQL commands to be issued and compromising the corresponding database.
Original NVD description (English source)
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS