CVE-2025-13238: Bdtask Flight Booking Software Edit Profile edit unrestricted upload

Published Nov 16, 2025

Updated

A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

BDTASK Flight Booking Software

BDTASK Flight Booking Software=4.0

Event History

Nov 16, 2025

CVE Published

via MITRE·05:32 AM

Data Sourced

via MITRE·05:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-13238?

CVE-2025-13238 is assessed as a critical vulnerability due to its potential for unrestricted file uploads.

How do I fix CVE-2025-13238?

To fix CVE-2025-13238, ensure to update the Bdtask Flight Booking Software to the latest version that addresses this vulnerability.

Which component is affected by CVE-2025-13238?

CVE-2025-13238 affects the Edit Profile Page functionality located at the file path /agent/profile/edit.

Can CVE-2025-13238 be exploited remotely?

Yes, CVE-2025-13238 can be exploited remotely, allowing attackers to manipulate the editing profile functionality.

What is the impact of CVE-2025-13238 on the Bdtask Flight Booking Software?

The impact of CVE-2025-13238 includes unauthorized access to upload malicious files, which can compromise the application's integrity.