CVE-2025-13129

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13129", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-11-13T14:18:04.058Z", "datePublished": "2025-12-01T14:32:22.456Z", "dateUpdated": "2026-06-04T06:39:21.633Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-04T06:39:21.633Z"}, "title": "Business Logic Error in Seneka Software's Onaylar\u0131m", "datePublic": "2025-12-01T13:21:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-841", "description": "CWE-841 Improper Enforcement of Behavioral Workflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "affected": [{"vendor": "Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co.", "product": "Onaylar\u0131m", "versions": [{"status": "affected", "version": "25.09.26.01", "lessThanOrEqual": "18112025", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.\n\nThis issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.<p>This issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025.</p>"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0422", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0422", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "S\u00fcleyman Mert ENG\u00dcR", "type": "finder"}, {"lang": "en", "value": "Furkan Umut CEYLAN", "type": "finder"}], "source": {"defect": ["TR-25-0422"], "advisory": "TR-25-0422", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-01T14:56:50.301007Z", "id": "CVE-2025-13129", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-01T14:57:17.506Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T14:56:50.301007Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-01T14:57:09.356Z"}}], "cna": {"title": "Business Logic Error in Seneka Software's Onaylar\u0131m", "source": {"defect": ["TR-25-0422"], "advisory": "TR-25-0422", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "S\u00fcleyman Mert ENG\u00dcR"}, {"lang": "en", "type": "finder", "value": "Furkan Umut CEYLAN"}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co.", "product": "Onaylar\u0131m", "versions": [{"status": "affected", "version": "25.09.26.01", "versionType": "custom", "lessThanOrEqual": "18112025"}], "defaultStatus": "unaffected"}], "datePublic": "2025-12-01T13:21:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0422", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0422", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.\n\nThis issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025.", "supportingMedia": [{"type": "text/html", "value": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.<p>This issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841 Improper Enforcement of Behavioral Workflow"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-04T06:39:21.633Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13129", "state": "PUBLISHED", "dateUpdated": "2026-06-04T06:39:21.633Z", "dateReserved": "2025-11-13T14:18:04.058Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-12-01T14:32:22.456Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Onaylar\u0131m", "vendor": "Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co.", "versions": [{"lessThanOrEqual": "18112025", "status": "affected", "version": "25.09.26.01", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar\u0131m allows Functionality Misuse.\n\nThis issue affects Onaylar\u0131m: from 25.09.26.01 through 18112025."}, {"lang": "es", "value": "Vulnerabilidad de aplicaci\u00f3n incorrecta del flujo de trabajo conductual en Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylar?m permite el uso indebido de la funcionalidad. Este problema afecta a Onaylar?m: desde 25.09.26.01 hasta 18112025."}], "id": "CVE-2025-13129", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13129", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-01T14:56:50.301007Z", "version": "2.0.3"}}]}, "published": "2025-12-01T15:15:48.857", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0422"}, {"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-25-0422"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-841"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"created": "2025-12-02T12:15:25.037976+00:00", "updated": "2025-12-02T12:15:25.038006+00:00", "vendors": ["seneka", "seneka$PRODUCT$onaylar\u0131m"]}