PT-2025-48319 · Uniong · Webitr

Published 2025-11-28 · Updated 2025-12-22 · CVE-2025-13768

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebITR versions (affected versions not specified)

Description WebITR developed by Uniong has an authentication bypass issue. Authenticated remote attackers can log in as any user by modifying a specific parameter. To exploit this, attackers must first obtain a user ID. The vulnerable parameter is not specified. The API endpoint is not specified. The function responsible for authentication is not specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13768

Affected Products

Webitr

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-13768 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13768 · Vendor Advisory
• https://twitter.com/dailycve/status/1995534611955216508 · Twitter Post
• https://twitter.com/DavidMarquet19/status/2003012773391781934 · Twitter Post
• https://t.me/cveNotify/144417 · Telegram Post
• https://twitter.com/cracbot/status/1996172624725245982 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994333957555409144 · Twitter Post
• https://twitter.com/CVEnew/status/1994312987016876523 · Twitter Post
• https://twcert.org.tw/en/cp-139-10539-21f45-2.html · Note
• https://t.me/CVEtracker/38431 · Telegram Post
• https://twcert.org.tw/tw/cp-132-10538-6a26d-1.html · Note
• https://t.me/cveNotify/144211 · Telegram Post