CVE-2025-13178 | Bdtask/CodeCanyon SalesERP up to 20250728 User Profile /edit_profile first_name/last_name cross site scripting

A vulnerability identified as problematic has been detected in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Profile Handler. This manipulation of the argument first_name/last_name causes basic cross site scripting.

This vulnerability is tracked as CVE-2025-13178. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.