CVE-2025-12222

MediumCVSS 6.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. It affects an unknown functionality in the Deposit Handler component, allowing unrestricted file upload. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

The risk includes the possibility of uploading malicious files to the server, potentially leading to system compromise, code execution, or data integrity violation.

Recommendation

Update the software to the latest version immediately and implement file upload controls (e.g., type and size validation).

Other vulnerabilities in Bdtask Flight Booking Software

CVE-2025-12223Medium
A vulnerability was detected in Bdtask Flight Booking Software up to 3.1 in the Package Information Module, file /b2c/package-information. Manipulation leads to unrestricted file upload. The attack can be launched remotely and the exploit is publicly available.

Original NVD description (English source)

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS