CVE-2025-12223

MediumCVSS 6.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A vulnerability was detected in Bdtask Flight Booking Software up to 3.1 in the Package Information Module, file /b2c/package-information. Manipulation leads to unrestricted file upload. The attack can be launched remotely and the exploit is publicly available.

Risk Assessment

An attacker can upload malicious files (e.g., webshell) and take control of the server. The vendor's lack of response increases the risk of no patches.

Recommendation

Implement file type and size restrictions and server-side validation. Consider switching to supported software or deploying custom protections.

Other vulnerabilities in Bdtask Flight Booking Software

CVE-2025-12222Medium
A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. It affects an unknown functionality in the Deposit Handler component, allowing unrestricted file upload. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS