TVN ID	TVN-202511012
CVE ID	CVE-2025-13768, CVE-2025-13769, CVE-2025-13770, CVE-2025-13771
CVSS	CVE-2025-13768： 7.5 (High) CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-13769： 6.5 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2025-13770： 6.5 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2025-13771： 6.5 (Medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products	WebITR version 2_1_0_33 and earlier
Description	CVE-2025-13768： WebITR has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability. CVE-2025-13769： WebITR has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. CVE-2025-13770： WebITR has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. CVE-2025-13771： WebITR has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
Solution	Update to version 2_1_0_34 or later
Credit	Linwz(DEVCORE)
Public Date	2025-11-28