PT-2025-40330 · Viday · Viday

Andrea Intilangelo · Published 2025-10-02 · Updated 2025-10-10 · CVE-2025-40646

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Viday (affected versions not specified)

Description The software exhibits a flaw that could allow an attacker to obtain sensitive customer information. This is achieved by intercepting HTTP requests and locating JWTs within the request payload. The JWTs contain sensitive user information, potentially exposing it to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

CVE-2025-40646

Affected Products

Viday

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-40646 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40646 · Vendor Advisory
• https://t.me/cveNotify/137147 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker · Note
• https://twitter.com/CVEnew/status/1973693362910683152 · Twitter Post
• https://t.me/cveNotify/138115 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday · Note
• https://twitter.com/VulmonFeeds/status/1973716819111256568 · Twitter Post
• https://t.me/CVEtracker/33911 · Telegram Post