What’s Vulnerable › Vulnerabilities

CVE-2025-13168: ury-erp ury pos_extend.py overrided_past_order_list sql injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-14 · updated 2026-10-19
• Weakness: CWE-74

Description

A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.

Affected products

• ury-erp ury: before 0.2.1 — fixed in 0.2.1

How to fix

Upgrade to a fixed version: ury-erp ury 0.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/ictrun/ury-vulns/blob/main/README.md
• https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps
• https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058
• https://github.com/ury-erp/ury/releases/tag/v0.2.1
• https://vuldb.com/?ctiid.332456
• https://vuldb.com/?id.332456
• https://vuldb.com/?submit.683984
• https://github.com/ictrun/ury-vulns/blob/main/README.md
• https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps

Get alerted when CVE-2025-13168 or the next vulnerability affects your stack