CVE-2025-40646

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40646
Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday
Configurations

Configuration 1 (hide)

cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:*
History

15 Jul 2026, 14:17

Type Values Removed Values Added
CWE CWE-79 CWE-200
Summary (en) Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. (en) Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.
References
  • {'url': 'https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker', 'tags': ['Third Party Advisory'], 'source': 'cve-coordination@incibe.es'}
  • () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday -

03 Nov 2025, 15:15

Type Values Removed Values Added
References () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker - () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker - Third Party Advisory
CPE cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Energycrm
Energycrm energy Crm

10 Oct 2025, 09:15

Type Values Removed Values Added
CWE CWE-200 CWE-79
References
  • {'url': 'https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday', 'source': 'cve-coordination@incibe.es'}
  • () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker -
Summary (en) Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload. (en) Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

02 Oct 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-02 10:15

Updated : 2026-07-15 14:17

NVD link : CVE-2025-40646

Mitre link : CVE-2025-40646

CVE.ORG link : CVE-2025-40646

JSON object : View

Products Affected

energycrm

  • energy_crm
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor