CVE-2025-40646

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday

Configurations

Configuration 1 (hide)

cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de cross-site scripting almacenado (XSS) en Energy CRM v2025 de Status Tracker Ltd, que consiste en un XSS almacenado debido a la falta de validación adecuada de la entrada del usuario al enviar una solicitud POST a '/crm/create_job_submit.php', utilizando el parámetro 'JobCreatedBy'. Esta vulnerabilidad podría permitir a un usuario remoto enviar una consulta especialmente diseñada a un usuario autenticado y robar los detalles de su sesión de cookie.

Information

Published : 2025-10-02 10:15

Updated : 2026-10-12 15:10

NVD link : CVE-2025-40646

Mitre link : CVE-2025-40646

CVE.ORG link : CVE-2025-40646

JSON object : View

Products Affected

energycrm

energy_crm

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-40646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40646", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-02T17:28:51.049237Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "ViDay", "product": "ViDay", "versions": [{"status": "affected", "version": "all versions"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-02T10:15:38.140", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting almacenado (XSS) en Energy CRM v2025 de Status Tracker Ltd, que consiste en un XSS almacenado debido a la falta de validaci\u00f3n adecuada de la entrada del usuario al enviar una solicitud POST a '/crm/create_job_submit.php', utilizando el par\u00e1metro 'JobCreatedBy'. Esta vulnerabilidad podr\u00eda permitir a un usuario remoto enviar una consulta especialmente dise\u00f1ada a un usuario autenticado y robar los detalles de su sesi\u00f3n de cookie."}], "lastModified": "2026-10-12T15:10:00.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33FF3150-4D6F-48B5-A482-DD5B83A670D4"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@incibe.es"}