CVE-2025-13178

LowCVSS 3.5

Published: 14/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

A cross-site scripting vulnerability was found in SalesERP (Bdtask/CodeCanyon) up to version 20250728, affecting the /edit_profile file in the User Profile Handler component. Manipulation of the first_name/last_name arguments allows script injection. The attack can be carried out remotely and a public exploit is available.

Risk Assessment

This XSS vulnerability could allow session hijacking or actions performed on behalf of the user, posing a risk to data confidentiality and integrity. Since the exploit is public, the risk of exploitation is high.

Recommendation

Update SalesERP to the latest version if the vendor provides a fix, or implement input validation and sanitization in the profile edit form. Until patched, consider restricting access to the administrative panel.

Other vulnerabilities in SalesERP

CVE-2025-13177Medium
A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. The manipulation results in cross-site request forgery (CSRF). The attack can be executed remotely and the exploit is publicly available.

Original NVD description (English source)

A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Profile Handler. This manipulation of the argument first_name/last_name causes basic cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS