What is the CVSS score of CVE-2025-40645?

CVE-2025-40645 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.1%.

Which versions of Viday. This are affected by CVE-2025-40645?

CVE-2025-40645 presents significant security risk, a information exposure vulnerability rated CVSS 8.7.

How to fix or mitigate CVE-2025-40645?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Viday. This CVE-2025-40645

EUVD-2025-32670 HIGH

Information Exposure (CWE-200)

2025-10-02 cve-coordination@incibe.es

Information Disclosure

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-32670

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

CVE Published

Oct 02, 2025 - 10:15 nvd

HIGH 8.7

DescriptionCVE.org

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).