CVE-2025-13168

creationtimestamp| type| source ---|---|--- 2026-01-09 16:02:27+00:00| published-proof-of-concept| Telegram/ECfwiHytRiuQjRt5hCp2x-jLr0ISxnPwTPjtlVUfska4wnI...

CVE-2025-13168 ury-erp ury pos_extend.py overrided_past_order_list sql injection

A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overridedpastorderlist of the file ury/ury/api/posextend.py. This manipulation of the argument searchterm causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available t...

CVE-2025-13168

Summary : CVE-2025-13168 affects the ury-erp component “ury” up to version 0.2.0. The vulnerability stems from the function overrided_past_order_list in file ury/ury/api/pos_extend.py where improper handling of the search_term argument enables an SQL injection. This allows remote exploitation, an...