Information disclosure in Viday

CVE-2025-40645

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter.

Vulnerability class: Information Disclosure

EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.

Affected products

  • Viday — versions all versions

Weakness classification (CWE)

References