CVE-2025-1395CWE-209

CVE-2025-1395

High · published January 30, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

⚡ Sensitive information leaks through error messages! Codriapp's HeyGarson app reveals juicy details during fuzzing, making it a prime target for attackers. 🔥 Think of it like a restaurant that accidentally posts its secret sauce recipe on the menu after a complaint — suddenly, competitors can replicate the dish without any effort! This vulnerability allows attackers to gather sensitive data about the application’s structure and security features, paving the way for more serious exploits. If they can map the application effectively, they might later execute sophisticated attacks that could compromise user data or the entire system.

Put simply

Think of it like a restaurant that accidentally posts its secret sauce recipe on the menu after a complaint — suddenly, competitors can replicate the dish without any effort! The error message generation flaw in HeyGarson can expose sensitive information when subjected to fuzzing. This allows attackers to glean insights into the application’s operations and potential weaknesses without needing user credentials.

What to do

This vulnerability allows attackers to gather sensitive data about the application’s structure and security features, paving the way for more serious exploits. If they can map the application effectively, they might later execute sophisticated attacks that could compromise user data or the entire system. Contact Codriapp to urge a patch for HeyGarson, ensuring the application doesn't disclose any sensitive information. Meanwhile, consider implementing a custom error handling mechanism to sanitize error messages and provide generic responses. Regular security audits can also help catch such vulnerabilities before they become a serious threat. You've got this! With a few quick steps, you can secure your application and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-01-30T14:15Z
References (2)
EPSS history
Timeline
  • 30 JAN 08:31Z
    Sensitive Data Exposure in CoDeriApp's HeyGarson
    cvelistv5