CVE-2025-40645

HighCVSS 8.7

Published: 02/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Viday exposes sensitive information. An unauthenticated attacker can obtain customer data by sending an HTTP GET request to /api/reserva/web/clients using the phone parameter.

Risk Assessment

Leakage of customer personal data may violate privacy and lead to legal consequences and loss of trust. Unauthenticated access lowers the exploitation barrier.

Recommendation

Restrict access to the /api/reserva/web/clients endpoint and enforce authentication and parameter validation. Contact the vendor for a patch.

Other vulnerabilities in Viday

CVE-2025-40646Medium
A vulnerability in Viday exposes sensitive information by allowing an attacker to intercept HTTP requests and extract JWT tokens containing user data in the payload.

Original NVD description (English source)

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS