CVE-2025-11145

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting.

This issue affects enVision: before 250566.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-203CWE-359

Affected software

VendorProductVersions
CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc.enVision< 250566

References

Timeline

Published
Oct 24, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-111465.4Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows an attacker to execute malicious scripts (XSS) in theCVE-2025-111475.4Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts (XSS) to be executed in “/html/<filCVE-2025-111489.8All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted withCVE-2025-111497.5This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an eCVE-2025-11155.5A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_closCVE-2025-111518.2Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulneCVE-2025-111528.6Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.0.3.CVE-2025-111537.5JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.CVE-2025-111545.4The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unautheCVE-2025-111556.8The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a stroCVE-2025-111565.9Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, auCVE-2025-111577.8A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer jo