CVE-2025-11151CWE-200CWE-497information-disclosure

CVE-2025-11151

High · published October 21, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

⚡ There's a high-severity vulnerability in CityPLus that could let unauthorized users peek at sensitive web pages! 🔍 Think of this as an office with a window that wasn’t sealed properly. Anyone walking by can see confidential documents stacked on the desk, even though they shouldn't be able to! An attacker could exploit this flaw to access sensitive system information, potentially leading to data leaks that could compromise user privacy and trust. Imagine losing crucial client data because someone slipped through the cracks — absolutely devastating!

Put simply

Think of this as an office with a window that wasn’t sealed properly. Anyone walking by can see confidential documents stacked on the desk, even though they shouldn't be able to! This vulnerability in CityPLus allows unauthorized actors to detect unpublicized web pages, exposing sensitive information due to improper access controls. Versions prior to V24.29500.1.0 are affected and at risk.

What to do

An attacker could exploit this flaw to access sensitive system information, potentially leading to data leaks that could compromise user privacy and trust. Imagine losing crucial client data because someone slipped through the cracks — absolutely devastating! Upgrade CityPLus to version V24.29500.1.0 or later immediately. Additionally, conduct a thorough audit of your access controls to ensure sensitive information remains protected. Don’t let your hard work be compromised! You've got this! With swift action, you’ll be securing your sensitive data in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2025-10-21T18:15Z
References (2)
EPSS history
Timeline
  • 21 OCT 13:15Z
    Information Disclosure in Beyaz Computer's CityPLus
    cvelistv5