Vulnerability details
CVE-2026-34906
Simple Wirtualna Uczelnia
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia
CVSS 4.0
9.3Critical
Official description
Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (CERT-PL) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Simple SA | Wirtualna Uczelnia | v ≤ wu#2016.437.295#0#20260327_105545 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://cert.pl/posts/2026/06/CVE-2026-34906 third-party-advisory
- https://simple.com.pl/branze/edukacyjna/ product
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-02
- Last updated
- 2026-06-02
- State
- Published
- Assigner (CNA)
- CERT-PL
Exploit prediction (EPSS)
0.55%
Probability of exploitation in 30 days
46.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1336Improper Neutralization of Special Elements Used in a Template Engine