CVE-2025-13811

HighCVSS 7.2/10Last modified Oct 18, 2026

Description

A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/constant/factory/PageFactory.java. Executing a manipulation of the argument sort can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-138124.3The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauth CVE-2025-138138.1A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the CVE-2025-138149.8A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl o CVE-2025-138159.8A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures.CVE-2025-138168.8A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of CVE-2025-138186.7Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent CVE-2025-138196.1Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external w CVE-2025-13826.1The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es CVE-2025-138205.3The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an atta CVE-2025-138215.7Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allow CVE-2025-138225.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allow CVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packe