CVE-2025-11025

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11025", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2025-09-26T08:09:24.845Z", "datePublished": "2025-09-26T12:40:31.008Z", "dateUpdated": "2026-06-04T19:46:20.740Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-04T19:46:20.740Z"}, "title": "Information Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform", "datePublic": "2025-09-26T12:34:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "Vimesoft Information Technologies and Software Inc.", "product": "Vimesoft Corporate Messaging Platform", "versions": [{"status": "affected", "version": "V1.3.0", "lessThan": "V2.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.<p>This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.</p>"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0300", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0300", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Berat AK\u015e\u0130T", "type": "finder"}, {"lang": "en", "value": "Sencer KILI\u00c7", "type": "finder"}, {"lang": "en", "value": "Berat AK\u015e\u0130T", "type": "reporter"}], "source": {"defect": ["TR-25-0300"], "advisory": "TR-25-0300", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-26T13:39:06.180229Z", "id": "CVE-2025-11025", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T13:39:22.861Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11025", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T13:39:06.180229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T13:39:12.784Z"}}], "cna": {"title": "Information Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform", "source": {"defect": ["TR-25-0300"], "advisory": "TR-25-0300", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Berat AK\u015e\u0130T"}, {"lang": "en", "type": "finder", "value": "Sencer KILI\u00c7"}, {"lang": "en", "type": "reporter", "value": "Berat AK\u015e\u0130T"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Vimesoft Information Technologies and Software Inc.", "product": "Vimesoft Corporate Messaging Platform", "versions": [{"status": "affected", "version": "V1.3.0", "lessThan": "V2.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-09-26T12:34:00.000Z", "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0300", "tags": ["government-resource", "broken-link"]}, {"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0300", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.", "supportingMedia": [{"type": "text/html", "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.<p>This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-04T19:46:20.740Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11025", "state": "PUBLISHED", "dateUpdated": "2026-06-04T19:46:20.740Z", "dateReserved": "2025-09-26T08:09:24.845Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2025-09-26T12:40:31.008Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vimesoft Corporate Messaging Platform", "vendor": "Vimesoft Information Technologies and Software Inc.", "versions": [{"lessThan": "V2.0.0", "status": "affected", "version": "V1.3.0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0."}, {"lang": "es", "value": "Vulnerabilidad de Inserci\u00f3n de Informaci\u00f3n Sensible en Datos Enviados en la Plataforma de Mensajer\u00eda Corporativa Vimesoft de Vimesoft Information Technologies and Software Inc. permite Recuperar Datos Sensibles Incrustados. Este problema afecta a la Plataforma de Mensajer\u00eda Corporativa Vimesoft: desde la V1.3.0 anterior a la V2.0.0."}], "id": "CVE-2025-11025", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11025", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-26T13:39:06.180229Z", "version": "2.0.3"}}]}, "published": "2025-09-26T13:15:41.540", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0300"}, {"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-25-0300"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:30:18.088909+00:00", "updated": "2025-09-29T09:30:18.088968+00:00", "vendors": ["vimesoft", "vimesoft$PRODUCT$vimesoft"]}