CVE-2025-13565CWE-640

CVE-2025-13565

Medium · published November 24, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2025-11-24T00:15Z
Affected products (1)
ProductVersionsFixed in
warren-daloyan/inventory_management_systemall versions—
References (5)
https://vuldb.com/?ctiid.333329 · [email protected]https://vuldb.com/?id.333329 · [email protected]https://vuldb.com/?submit.697984 · [email protected]https://www.notion.so/Unauthenticated-Password-Reset-Vulnerability-in-SourceCodester-Inventory-Management-System-2b023917db8c8001b5ecf4c50a54dfbd?source=copy_link · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 23 NOV 19:02Z
    SourceCodester Inventory Management System resetPassword.php password recovery
    cvelistv5