Information disclosure in Energycrm Energy Crm
CVE-2025-40646
Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.
Vulnerability class: Information Disclosure
EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Energycrm Energy_crm — versions 2025
- Status Tracker Energy Crm — versions version 2025
- Viday — versions all versions
Weakness classification (CWE)
References
- cve-coordination@incibe.es (Third Party Advisory)
- cve-coordination@incibe.es
Frequently asked questions
- What is CVE-2025-40646?
- CVE-2025-40646 is a medium-severity vulnerability in Energycrm Energy Crm, classified under Information Disclosure. CVSS score: 5.4/10. Published 2025-10-02.
- How severe is CVE-2025-40646?
- Medium severity. CVSS v3 base score is 5.4 out of 10.