CVE-2025-13776

Published: Feb 24, 2026Modified: Jun 17, 2026

8.6

Vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: cvd@cert.pl (Secondary)

Description

Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3

Affected (6)

Products: Finka: Finka Faktura, Finka Fk, Finka Kpr, Finka Magazyn, Finka Place, Finka Stw

6 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Finka Finka Faktura	Before 18.3
Finka Finka Fk	Before 18.5
Finka Finka Kpr	Before 16.6
Finka Finka Magazyn	Before 8.3
Finka Finka Place	Before 13.4
Finka Finka Stw	Before 12.3

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (2)

https://cert.pl/en/posts/2026/01/CVE-2025-13776

Source: cvd@cert.pl

Broken Link

https://finka.pl/

Source: cvd@cert.pl

Product

Timeline

No history available yet.