CVE-2025-64308

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-523

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-643097.4The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users wheCVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker couCVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativCVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiaCVE-2025-643127.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service conCVE-2025-643135.5Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-643145.5Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentCVE-2025-643157.1Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data CVE-2025-643185.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating WriteCVE-2025-643195.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating WriteabCVE-2025-64328.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxCVE-2025-643206.5Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This is