CVE-2025-13829

HighCVSS 8.6

Published: 01/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

An Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved includes APIKEY (1 year user session), RefreshToken (10 minutes user session), Password hashed with bcrypt, User IP, Email, and Full Name.

Risk Assessment

The risk includes violation of user privacy and potential identity theft, as attackers can obtain credentials and personal data.

Recommendation

It is recommended to immediately apply vendor patches. Also, restrict access to the application and monitor user activity for unauthorized access attempts.

Other vulnerabilities in NGSurvey

CVE-2025-15479Medium
Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 has a stored XSS (CWE-79) vulnerability in survey content and administration functionality. Authenticated users with survey creation or edit privileges can execute arbitrary JavaScript in other users' browsers, steal session information, and perform unauthorized actions.

Original NVD description (English source)

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: * APIKEY (1 year user Session) * RefreshToken (10 minutes user Session) * Password hashed with bcrypt * User IP * Email * Full Name

Vulnerability data from NVD (NIST) · CISA KEV · EPSS