CVE-2025-13238

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-434

Affected software

Vendor	Product	Versions
Bdtask	Flight Booking Software	4

References

https://github.com/4m3rr0r/PoCVulDb/issues/6Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.332564Permissions Required, VDB Entry
https://vuldb.com/?id.332564Third Party Advisory, VDB Entry
https://vuldb.com/?submit.686895Third Party Advisory, VDB Entry

Timeline

Published: Nov 16, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-132397.5A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issu CVE-2025-13245.4The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'p CVE-2025-132409.8A vulnerability was detected in code-projects Student Information System 2.0. This affects an unknown part of the file /searchquery.php. Per CVE-2025-132419.8A flaw has been found in code-projects Student Information System 2.0. This vulnerability affects unknown code of the file /index.php. Execu CVE-2025-132429.8A vulnerability has been found in code-projects Student Information System 2.0. This issue affects some unknown processing of the file /regi CVE-2025-132438.8A vulnerability was found in code-projects Student Information System 2.0. Impacted is an unknown function of the file /editprofile.php. The CVE-2025-132446.1A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /reg CVE-2025-132455.4A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /edi CVE-2025-132466.3A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Impacted is the function CVE-2025-132479.8A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. The affected element is an unknown function of the file /ad CVE-2025-132489.8A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is an unknown funct CVE-2025-132496.3A security vulnerability has been detected in Jiusi OA up to 20251102. This affects an unknown function of the file /OfficeServer?isAjaxDown