Information Exposure Vulnerability in Viday by Viday Technologies

CVE-2025-40645

What is CVE-2025-40645?

The Viday application is susceptible to an information exposure vulnerability that permits unauthenticated users to exploit an insecure API endpoint. By manipulating the 'phone' parameter in an HTTP GET request directed at '/api/reserva/web/clients', attackers can retrieve sensitive customer information, raising serious concerns regarding data privacy and security for users of the platform. It is imperative for organizations using Viday to implement necessary security measures to protect against unauthorized data access.

References