CVE-2025-13238

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-13238
A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/4m3rr0r/PoCVulDb/issues/6 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.332564 Permissions Required VDB Entry
https://vuldb.com/?id.332564 Third Party Advisory VDB Entry
https://vuldb.com/?submit.686895 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:bdtask:flight_booking_software:4.0:*:*:*:*:*:*:*
History

24 Feb 2026, 07:16

Type Values Removed Values Added
Summary (en) A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. (en) A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
References () https://github.com/4m3rr0r/PoCVulDb/issues/6 - Exploit, Third Party Advisory, Issue Tracking () https://github.com/4m3rr0r/PoCVulDb/issues/6 - Exploit, Issue Tracking, Third Party Advisory

21 Nov 2025, 22:00

Type Values Removed Values Added
CPE cpe:2.3:a:bdtask:flight_booking_software:4.0:*:*:*:*:*:*:*
References () https://github.com/4m3rr0r/PoCVulDb/issues/6 - () https://github.com/4m3rr0r/PoCVulDb/issues/6 - Exploit, Third Party Advisory, Issue Tracking
References () https://vuldb.com/?ctiid.332564 - () https://vuldb.com/?ctiid.332564 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.332564 - () https://vuldb.com/?id.332564 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.686895 - () https://vuldb.com/?submit.686895 - Third Party Advisory, VDB Entry
First Time Bdtask
Bdtask flight Booking Software

16 Nov 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-16 06:15

Updated : 2026-02-24 07:16

NVD link : CVE-2025-13238

Mitre link : CVE-2025-13238

CVE.ORG link : CVE-2025-13238

JSON object : View

Products Affected

bdtask

  • flight_booking_software
CWE
CWE-284

Improper Access Control

CWE-434

Unrestricted Upload of File with Dangerous Type