CVE-2025-13252CWE-259CWE-798hardcoded-credentials

CVE-2025-13252

High · published November 17, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functionality of the component RSA/OAuth2/Database. The manipulation results in hard-coded credentials. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.5th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2025-11-17T04:15Z
References (5)
https://github.com/shsuishang/modulithshop/issues/2 · [email protected]https://github.com/shsuishang/modulithshop/issues/2#issue-3580272472 · [email protected]https://vuldb.com/?ctiid.332587 · [email protected]https://vuldb.com/?id.332587 · [email protected]https://vuldb.com/?submit.687685 · [email protected]
EPSS history
Timeline
  • 16 NOV 23:02Z
    shsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentials
    cvelistv5