CVE-2025-13768
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Risk Assessment
An attacker can take over other users' accounts, potentially leading to unauthorized access to data and actions in the system.
Recommendation
Update WebITR to a patched version. Additionally, implement monitoring and access restriction mechanisms.
Other vulnerabilities in WebITR
See all- CVE-2025-13771Medium
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
- CVE-2025-13770Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13769Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Original NVD description (English source)
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS