AVESİS EUVD-2026-85259

Exploitation requires the attacker to craft a URL targeting the manipulable redirect parameter on an AVESİS instance running an affected build (202608201331 up to but not including 202608240351), and to induce a victim to click that link (UI:R). No authentication or special privilege is needed (PR:N), and it works remotely over the network against default web-facing configurations, but success is limited by the social-engineering step - the victim must be lured into clicking - which caps real-world impact to phishing and redirection rather than direct data or system compromise.

This is a moderate-severity open redirect (CWE-601) with a vendor-supplied CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), which I concur with. The network vector and no-authentication requirement (PR:N) make it broadly reachable, but exploitation is gated by required user interaction (UI:R) - a victim must click an attacker-crafted link - so this is not self-propagating or automatable. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, meaning there is no evidence of active or automated exploitation. This is a real but low-urgency issue: open redirects are primarily phishing and credential-theft enablers rather than direct system-compromise vectors, and the limited C:L/I:L impact reflects that. Compared to a high-CVSS RCE, this is a lower operational priority; the main risk driver is the product's use as a trusted university-branded domain that lends credibility to phishing lures. No key data is directly conflicting - CVSS network vector is consistent with a web open-redirect described as 'Input Data Manipulation.'

An attacker crafts a URL on the trusted AVESİS domain that manipulates a redirect parameter to point to an attacker-controlled phishing site, then distributes it via email or social media to university staff. A victim clicks the link, trusts it because it begins with the legitimate institution's domain, and is silently redirected to a credential-harvesting page. No public exploit code was identified in the provided intelligence.