CVE-2025-12266 | Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009 /index.php/auth/widget _empty get.layer/get.widget/get.action code injection

A vulnerability classified as critical has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection.

This vulnerability is reported as CVE-2025-12266. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.