CVE-2025-13283

HighCVSS 7.1/10Last modified Oct 7, 2026

Description

TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, which poses a potential risk of information leakage or could consume hard drive space by copying files in large volumes.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-36 CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-132849.8ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS c CVE-2025-132859.8A vulnerability was identified in itsourcecode Online Voting System 1.0. The affected element is an unknown function of the file /login.php.CVE-2025-132868.8A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.CVE-2025-132878.8A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=catego CVE-2025-132888.8A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUser CVE-2025-132898.8A vulnerability was detected in 1000projects Design & Development of Student Database Management System 1.0. Affected is an unknown function CVE-2025-13297.8IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to fai CVE-2025-132908.8A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-132919.8A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.CVE-2025-132927.6A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs bel CVE-2025-132939.3A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-le CVE-2025-132949.3An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporat