CVE-2025-58585

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published
Oct 6, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-585865.3For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwoCVE-2025-585879.8The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making CVE-2025-585896.5When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as otCVE-2025-58598.8A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerCVE-2025-585907.5It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.CVE-2025-585917.5A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application CVE-2025-585928.1Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue CVE-2025-585936.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeCVE-2025-585944.3Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCVE-2025-585955.3Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affCVE-2025-585965.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allCVE-2025-585974.3Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Acce
CVE-2025-58585: High severity, CVSS 7.5 | Vulnix