CVE-2025-55342
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Quipux 4.0.1 through e1774ac allows enumeration of usernames and access to the Ecuadorian identification number for all registered users via the txt_login parameter in Administracion/usuarios/cambiar_password_olvido_validar.php.
Risk Assessment
An attacker can harvest user identification data, facilitating social engineering, account takeover, and violating privacy (personal data).
Recommendation
Limit information disclosure in endpoint responses, implement uniform error messages, and update Quipux to a non-vulnerable version.
Other vulnerabilities in Quipux
See all- CVE-2025-55343Critical
Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via multiple parameters in various PHP files, including busqueda/busqueda.php, anexos_lista.php, Administracion/listas/*.php, asociar_documentos/*.php, radicacion/*.php, reportes/reporte_TraspasoDocFisico.php, tx/*.php, and uploadFiles/cargar_doc_digitalizado_paginador.php.
- CVE-2025-55341Medium
A Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac affects anexos/anexos_nuevo.php via the asocImgRad parameter. The vulnerability allows injection of malicious script that may execute in the user's browser.
Original NVD description (English source)
Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiar_password_olvido_validar.php txt_login parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS