CVE-2025-13770
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Risk Assessment
An attacker with a valid account can read confidential data from the database, potentially leading to a confidentiality breach. The vulnerability is easily exploitable remotely.
Recommendation
Apply the patches provided by Uniong as soon as possible. Until then, restrict access to the WebITR system and monitor for unusual queries.
Other vulnerabilities in WebITR
See all- CVE-2025-13771Medium
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
- CVE-2025-13769Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13768High
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Original NVD description (English source)
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS