CVE-2025-13148

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-620

Affected software

Vendor	Product	Versions
IBM	Aspera Orchestrator	>= 4.0.0, <= 4.1.0

References

https://www.ibm.com/support/pages/node/7254434Vendor Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-131494.3The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulne CVE-2025-13159.8The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. T CVE-2025-131517.5Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overfl CVE-2025-131527.8A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local au CVE-2025-131536.1The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the da CVE-2025-131545.5An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated loca CVE-2025-131557.8An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with CVE-2025-131568.8The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type vali CVE-2025-131575.3The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin CVE-2025-131589.3Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript obj CVE-2025-131597.1The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all CVE-2025-13169.8Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on