CVE-2025-13177

MediumCVSS 4.3

Published: 14/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. The manipulation results in cross-site request forgery (CSRF). The attack can be executed remotely and the exploit is publicly available.

Risk Assessment

Organizations using SalesERP may be exposed to unauthorized actions performed on behalf of logged-in users. The public exploit increases the risk of exploitation.

Recommendation

Update SalesERP to the latest version or implement CSRF protections. Monitor logs for suspicious requests.

Other vulnerabilities in SalesERP

CVE-2025-13178Low
A cross-site scripting vulnerability was found in SalesERP (Bdtask/CodeCanyon) up to version 20250728, affecting the /edit_profile file in the User Profile Handler component. Manipulation of the first_name/last_name arguments allows script injection. The attack can be carried out remotely and a public exploit is available.

Original NVD description (English source)

A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS