CVE-2025-13276

HighCVSS 7.3/10Last modified Oct 7, 2026

Description

A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-132779.8A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphotoCVE-2025-132788.8A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borroweCVE-2025-132798.8A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profileCVE-2025-13285.4The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter iCVE-2025-132809.8A vulnerability was determined in CodeAstro Simple Inventory System 1.0. The impacted element is an unknown function of the file /index.php CVE-2025-132815.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClassCVE-2025-132828.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web serverCVE-2025-132837.1TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local wCVE-2025-132849.8ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS cCVE-2025-132859.8A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php.CVE-2025-132868.8A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.CVE-2025-132878.8A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=catego
CVE-2025-13276: High severity, CVSS 7.3 | Vulnix