CVE-2025-13180

16th percentile - higher than 16% of all known CVEs

A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320 affecting an unknown function of the file /edit_profile. Manipulation of the first_name/last_name arguments results in basic cross-site scripting; the attack can be initiated remotely and the exploit has been made public. The vendor did not respond to the disclosure.

A publicly available exploit enables remote script injection, potentially leading to user session theft and unauthorized actions in the system.

Implement input validation and sanitization in profile fields and restrict access to the application. Monitor vendor communications, as no fix has been confirmed.