XSS in Bdtask Wholesale
CVE-2025-13180
A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of the file /edit_profile. Performing manipulation of the argument first_name/last_name results in basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS: 0.002 (13.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Bdtask Wholesale
- Bdtask Wholesale Inventory Control And Management System — versions 20250320
- Codecanyon Wholesale Inventory Control And Management System — versions 20250320
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Third Party Advisory, exploit, Issue Tracking)
Frequently asked questions
- What is CVE-2025-13180?
- CVE-2025-13180 is a low-severity vulnerability in Bdtask Wholesale, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.5/10. Published 2025-11-14.
- How severe is CVE-2025-13180?
- Low severity. CVSS v3 base score is 3.5 out of 10.