CVE-2025-13565 is a medium severity weak password recovery flaw (CVSS 5.3) in SourceCodester Inventory Management System 1.0, affecting the password reset file /model/user/resetPassword.php. No fixed version is listed, so cut exposure and check the vendor for a patch.
What's affected
The affected component is the password reset file /model/user/resetPassword.php. The record says the flaw can lead to weak password recovery and the attack can be performed remotely.
Affected version: 1.0. The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The weakness classes are CWE-640.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
This is a standalone PHP application, so look for it on your servers rather than in a dependency list.
find /var/www -type f -name "resetPassword.php" 2>/dev/null
If the file exists, review how it works. A safe password reset needs a random, single-use, time-limited token sent to the account owner, and it must verify that token before changing anything. The reference to an unauthenticated password reset in the record's own link title suggests this check is missing, so read the code and test it on a non-production copy.
Review your web logs for requests to the reset path, especially ones for accounts that did not ask for a reset.
What to do now
- Find every copy of the Inventory Management System you run.
- Remove the reset page from public access, or restrict the application to your internal network.
- If you maintain the code, require a random single-use token delivered by email, and expire it quickly.
- Force a password change for administrator accounts and look for unexpected logins.
- Review who has access to the inventory data and whether it needs to be online at all.
Why it matters
Weak password recovery (CWE-640) is a flaw in the process that is meant to restore access for a legitimate user. When the process does not prove identity, resetting a password becomes the easiest route to taking over an account.
The score is modest at 5.3 because the vector lists only an integrity impact. In practice, an account takeover on an administrator account can lead to much more than that, so judge it against what the accounts in the application can do.
Quick check
Why is the score only 5.3?
The vector lists no confidentiality or availability impact and a low integrity impact. The attack vector is the network, and the vector lists no privileges required, so an unauthenticated visitor who can reach the service is in scope. The real risk depends on which accounts can be reset.
Is there a fix?
The record names no fixed version or vendor patch, so check the vendor site before assuming one exists.
Sources
- Gold vulnerability page for CVE-2025-13565
- CVE record for CVE-2025-13565 as published by its CNA, with a published date of 2025-11-23
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
