CVE-2025-11145CWE-200CWE-203CWE-359information-disclosure

CVE-2025-11145

High · published October 24, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

⚡ A sneaky vulnerability in EnVision could leave your personal data exposed to unauthorized eyes, and it's as easy as account footprinting! 🔍 Think of this like a storefront with big windows where anyone can peek in and see private information — if your shop has no curtains, potential intruders can easily take notes about your valuable data. An unauthorized actor could exploit this flaw to gather sensitive personal information about users, opening the door for identity theft or targeted attacks. If attackers understand users thoroughly, they may craft convincing phishing attempts or worse — the risk to privacy is absolutely devastating!

Put simply

Think of this like a storefront with big windows where anyone can peek in and see private information — if your shop has no curtains, potential intruders can easily take notes about your valuable data. This vulnerability allows unauthorized individuals to access sensitive personal information due to a lack of proper security checks in EnVision before version 250566. It essentially enables account footprinting, where users' private details can be harvested easily.

What to do

An unauthorized actor could exploit this flaw to gather sensitive personal information about users, opening the door for identity theft or targeted attacks. If attackers understand users thoroughly, they may craft convincing phishing attempts or worse — the risk to privacy is absolutely devastating! Update your EnVision software to version 250566 or later immediately to close this potential information leak. Conduct a security audit to ensure that sensitive information is adequately protected and not inadvertently exposed. 🛡️ You've got this! With a quick update, you can ensure your sensitive personal information stays safe and sound. 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-203 · Observable Discrepancy; CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2025-10-24T19:15Z
References (2)
EPSS history
Timeline
  • 24 OCT 14:25Z
    User Enumeration in CBK Soft's enVision
    cvelistv5