CVE-2025-13474

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers.

This issue affects Mobile App: before 9.5.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-134757.3In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. ConseCVE-2025-134769.8Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacCVE-2025-134777.1Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations CVE-2025-134788.4Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another userCVE-2025-134797.5Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation CVE-2025-13484.0IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obCVE-2025-134806.5Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperCVE-2025-134818.8IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the CVE-2025-134838.8SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs. This allows an unauthenticated attacker to bypass the login screen usiCVE-2025-134846.1A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of CVE-2025-134859.8A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the filCVE-2025-134869.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the
CVE-2025-13474: High severity, CVSS 7.5 | Vulnix