CVE-2026-113404
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
WebITR developed by Uniong has an insecure deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Risk Assessment
An authenticated attacker can take control of the application server, leading to full system and data compromise. The hard-coded key significantly lowers the bar for exploitation.
Recommendation
Update WebITR to a fixed version and remove the hard-coded cryptographic key. Restrict access to the application and monitor for suspicious deserialization requests.
Other vulnerabilities in WebITR
See all- CVE-2025-13771Medium
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
- CVE-2025-13770Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13769Medium
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2025-13768High
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Original NVD description (English source)
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS