CVE-2025-13901

MediumCVSS 5.3/10Last modified Jun 23, 2026

Description

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2026
Last modified: Jun 23, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-139025.4CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition CVE-2025-139036.4The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to CVE-2025-139046.4The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up CVE-2025-139057.0CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or mo CVE-2025-139066.4The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, CVE-2025-139076.4The CSS3 Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to CVE-2025-139086.4The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions u CVE-2025-139094.3The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic CVE-2025-13915.4A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username CVE-2025-139106.1The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all ve CVE-2025-139116.4Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code CVE-2025-139121.0Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimization