CVE-2025-40646CWE-200information-disclosure

CVE-2025-40646

Medium · published October 2, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-10-02T14:15Z
Affected products (1)
ProductVersionsFixed in
energycrm/energy_crmall versions—
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday · [email protected]
EPSS history
Timeline
  • 02 OCT 09:42Z
    Exposure of sensitive information in Viday
    cvelistv5