CVE-2025-13147

MediumCVSS 5.3/10Last modified Oct 18, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
ProgressMOVEit Transfer< 2024.1.8; >= 2025.0.0, < 2025.0.4

References

Timeline

Published
Nov 19, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-131486.5IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knoCVE-2025-131494.3The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulneCVE-2025-13159.8The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. TCVE-2025-131517.5Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflCVE-2025-131527.8A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local auCVE-2025-131536.1The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the daCVE-2025-131545.5An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated locaCVE-2025-131557.8An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code withCVE-2025-131568.8The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type valiCVE-2025-131575.3The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includinCVE-2025-131589.3Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript objCVE-2025-131597.1The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all