CVE-2025-13396 in Courier Management System

Résumé

par MITRE • 19/11/2025

A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: VulDB
• Divulgation: 19/11/2025
• Modérer: accepté
• Entrée: VDB-332924
• CPE: prêt
• CWE: CWE-89 (confirmé)
• Exploitation: Télécharger
• CVSS: 9.8 (NVD)
• EPSS: 0.00316
• KEV: non
• Activités: très faible
• Secteur: Finance, Industry, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-13396
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-13396
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-13396/