CVE-2025-13209
BaseFortify
Publication date: 2025-11-15
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bestfeng | oa_git_free | 9.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
| CWE-610 | The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a weakness in the bestfeng oa_git_free software up to version 9.5, specifically in the updateWriteBack function of the WorkflowPredefineController.java file. It involves manipulation of the argument writeProp that leads to an XML External Entity (XXE) reference, which can be exploited remotely.
How can this vulnerability impact me? :
The vulnerability can be exploited remotely to manipulate XML processing, potentially allowing an attacker to access or manipulate sensitive data, cause denial of service, or execute other malicious actions depending on the system's handling of XML external entities.