CVE-2025-13771
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
Risk Assessment
An authenticated attacker can read sensitive system files, potentially leading to leakage of confidential data. The vulnerability requires valid credentials but can be exploited by an internal user.
Recommendation
Update WebITR to the latest version and review user permissions. Monitor access to system files.
Other vulnerabilities in WebITR
See all- CVE-2025-13770Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13769Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13768High
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Original NVD description (English source)
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS