CVE-2025-13250
Medium · 6.3CVSS
6.3
EPSS
0.4%
Published
Nov 16, 2025
CISA due date
—
The record
A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler. Performing manipulation results in improper access controls. The attack may be initiated remotely. The exploit is now public and may be used.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
- CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
- CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
- CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266
- CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. CWE-266
- CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution… CWE-266
- CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. CWE-266
- CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. CWE-266