CVE-2025-40645CWE-200information-disclosure
CVE-2025-40645
published October 2, 2025
What it is
Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter.
The record
Technical detail
- CVSS
- 8.7 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00336 · 25.8th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2025-10-02T14:15Z
References (1)
EPSS history
Timeline