CVE-2025-13177CWE-352CWE-862broken-access-controlcsrf

CVE-2025-13177

Medium · published November 15, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2025-11-15T00:15Z
Affected products (1)
ProductVersionsFixed in
bdtask/saleserp≤ 2025-10-16—
References (5)
https://github.com/4m3rr0r/PoCVulDb/issues/1 · [email protected]https://vuldb.com/?ctiid.332467 · [email protected]https://vuldb.com/?id.332467 · [email protected]https://vuldb.com/?submit.684819 · [email protected]https://github.com/4m3rr0r/PoCVulDb/issues/1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 NOV 19:02Z
    Bdtask/CodeCanyon SalesERP cross-site request forgery
    cvelistv5