First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-13758

LowCVSS 3.5/10Last modified Oct 18, 2026

Description

Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-522

Affected software

Vendor	Product	Versions
Devolutions	Server	<= 2025.2.20; <= 2025.3.8

References

https://devolutions.net/security/advisories/DEVO-2025-0018/Vendor Advisory

Timeline

Published: Nov 27, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-13764.7A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library CVE-2025-137619.6GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowe CVE-2025-137624.8Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when try CVE-2025-137635.7Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack req CVE-2025-137649.8The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the CVE-2025-137654.3Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: be CVE-2025-137665.4The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and CVE-2025-137674.3Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership whe CVE-2025-137688.8WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any CVE-2025-137696.5WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to re CVE-2025-13775.5A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx CVE-2025-137706.5WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to re