CVE-2025-12738

LowCVSS 1.3/10Last modified Jun 17, 2026

Description

Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has some legitimate access to the database. The vulnerability allows attacker without read access to a property to infer information about its value by trying to enumerate all possible values through observing error messages of SET property. We recommend upgrading to 2025.11.2 or 5.26.17 and above, where the issues is fixed.

Metrics

CVSS 4.0 1.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:X/U:X

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-127397.3An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-sup CVE-2025-12747.8A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may le CVE-2025-127407.7A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to exe CVE-2025-127417.7A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execut CVE-2025-127427.5A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver paramet CVE-2025-127436.0The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a CVE-2025-127448.8A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input an CVE-2025-127457.8A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of CVE-2025-127466.1The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and incl CVE-2025-127475.3The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marke CVE-2025-127485.5A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before CVE-2025-12757.8A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A