CVE-2025-13776
Published: 24 February 2026
Summary
CVE-2025-13776 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Finka Finka-Faktura. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 6.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enables users to notice when hard-coded credentials have been exploited for unauthorized access.
Security training explicitly warns against hard-coded credentials, lowering their use in systems.
Policy and procedures prohibit hard-coded credentials in favor of managed authentication.
External identity providers eliminate the need for hard-coded credentials in applications.
Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.
Planned investment enables secure credential storage and management systems instead of hard-coded credentials.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded DB credentials directly enable credential abuse (T1552.001) for unauthorized DB access (T1213.006) and modification (T1565.001).
NVD Description
Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version:…
more
Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3
Deeper analysisAI
CVE-2025-13776 is a vulnerability in multiple Finka programs, including Finka-FK, Finka-KPR, Finka-Płace, Finka-Faktura, Finka-Magazyn, and Finka-STW, stemming from the use of hard-coded Firebird database credentials shared across all instances of the software. Classified under CWE-798 (Use of Hard-coded Credentials), it allows unauthorized access to database contents. The issue carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and was published on 2026-02-24.
A malicious attacker on the local network who knows the default credentials can exploit this vulnerability to read and edit database content. Exploitation requires local access, low attack complexity, and low privileges, with no user interaction needed, leading to high confidentiality and integrity impacts but no availability disruption.
The vulnerability has been fixed in the following versions: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, and Finka-STW 12.3. Additional mitigation details are available in the advisory at https://cert.pl/en/posts/2026/01/CVE-2025-13776 and on the vendor site at https://finka.pl/.
Details
- CWE(s)