CVE-2025-1395

HighCVSS 8.2/10Last modified Aug 7, 2026

Description

Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping.

This issue affects HeyGarson: through 30012026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2026
Last modified: Aug 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-139505.3The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c CVE-2025-139529.8A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free c CVE-2025-139539.3Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) logi CVE-2025-139549.3Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and ga CVE-2025-139559.3Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range CVE-2025-139565.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on CVE-2025-139577.5CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Pro CVE-2025-139585.9The YaMaps for WordPress Plugin WordPress plugin before 0.6.40 does not validate and escape some of its shortcode attributes before outputti CVE-2025-139596.4The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up t CVE-2025-13965.3A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the syst CVE-2025-139606.4The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, CVE-2025-139616.4The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions