CVE-2025-11065

MediumCVSS 5.3/10Last modified Jun 30, 2026

Description

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2026
Last modified
Jun 30, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-110669.8A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. ECVE-2025-110674.8A vulnerability has been found in Projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /myform.php of thCVE-2025-110684.8A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/cateCVE-2025-110694.8A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save CVE-2025-11079.9Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another useCVE-2025-110709.8A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. SuCVE-2025-110717.2A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the compoCVE-2025-110725.3The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allCVE-2025-110734.7A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of thCVE-2025-110749.8A flaw has been found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /login.php. ThCVE-2025-110759.8A vulnerability has been found in Campcodes Online Learning Management System 1.0. This affects an unknown function of the file /admin/de_acCVE-2025-110769.8A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_teach
CVE-2025-11065: Medium severity, CVSS 5.3 | Vulnix