CVE-2025-13162

MediumCVSS 4.4/10Last modified Oct 6, 2026

Description

Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master.

This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 23, 2026
Last modified
Oct 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-131634.9EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain pCVE-2025-131644.9EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain pCVE-2025-131657.5EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests CVE-2025-131663.7The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based onCVE-2025-131675.4Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology ContCVE-2025-131689.8A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_eCVE-2025-131699.8A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown cCVE-2025-131709.8A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the CVE-2025-131718.8A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of theCVE-2025-131728.8A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-rCVE-2025-131736.5Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiaCVE-2025-131746.3A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /r
CVE-2025-13162: Medium severity, CVSS 4.4 | Vulnix