CVE-2025-13119

MediumCVSS 4.3

Published: 13/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability was found in Simple E-Banking System 1.0. An attacker can remotely force a logged-in user to perform unintended actions. The exploit has been publicly disclosed and may be used.

Risk Assessment

Users may be forced to perform unauthorized banking operations or modify data in their context. The public exploit increases the risk of real-world attacks.

Recommendation

Implement CSRF tokens and Origin/Referer header validation for all state-changing requests. Until patched, consider restricting access to the application.

Other vulnerabilities in Simple E-Banking System

CVE-2025-12244Medium
A cross-site scripting (XSS) vulnerability was found in Simple E-Banking System 1.0 in the file /eBank/register.php. Manipulation of the Username argument allows injection of malicious script. The attack can be launched remotely and the exploit has been publicly disclosed.

Original NVD description (English source)

A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS