CVE-2025-40646

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...

CVE-2025-40645

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter...

CVE-2025-40646 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...

CVE-2025-40645 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter...

CVE-2025-40645 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter...

CVE-2025-40645

CVE-2025-40645 relates to ViDay/Viday. An unauthenticated attacker can retrieve sensitive customer information by issuing an HTTP GET to /api/reserva/web/clients with the phone parameter. Technical details from sources: CVSS v4.0 base score 8.7 (HIGH) with NETWORK attack vector, LOW attack comple...

PT-2025-40330

Name of the Vulnerable Software and Affected Versions Viday affected versions not specified Description The software exhibits a flaw that could allow an attacker to obtain sensitive customer information. This is achieved by intercepting HTTP requests and locating JWTs within the request payload...

US Auto Insurance Platform ClaimPix Leaked 10.7TB of Records Online

Cybersecurity researcher Jeremiah Fowler discovered a massive 10.7TB ClaimPix leak exposing 5.1M customer files, vehicle data, and Power of Attorney documents. Read the full details...

Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection

Cybersecurity researchers have disclosed a critical flaw impacting Salesforce Agentforce, a platform for building artificial intelligence AI agents, that could allow attackers to potentially exfiltrate sensitive data from its customer relationship management CRM tool by means of an indirect promp...

Gucci, Balenciaga and Alexander McQueen Breach Linked to ShinyHunters

ShinyHunters reportedly hacked Kering, exposing Gucci, Balenciaga and Alexander McQueen customer data, raising risks of scams and spear…...

Linux Distros Unpatched Vulnerability : CVE-2023-4198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control in Dolibarr ERP CRM = v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data CVE-2023-4198...

Linux Distros Unpatched Vulnerability : CVE-2023-33568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects,...

Carmaker Portal Flaw Could Let Hackers Unlock Cars, Steal Data

A security vulnerability in a major carmaker's online portal exposed customer data and could have let hackers remotely…...

Bouygues Telecom Hit by Cyberattack, 6.4 Million Customers Affected

A cyberattack on Bouygues Telecom exposed data for 6.4 million customers. Find out what information was compromised and…...

ShinyHunters Target Chanel in Salesforce Linked Data Breach

ShinyHunters breached Chanel’s US client database via Salesforce-linked access, exposing limited customer details through social engineering tactics...

Pandora Cyber Attack Exposes Customer Data Via Third-Party Vendor

Pandora cyber attack exposes customer data via third-party breach. No passwords or payment info leaked, but phishing risks remain...

Spying on People Through Airportr Luggage Delivery Service

Airportr is a service that allows passengers to have their luggage picked up, checked, and delivered to their destinations. As you might expect, it's used by wealthy or important people. So if the company's website is insecure, you'd be able to spy on lots of wealthy or important people. And mayb...

Louis Vuitton UK Hit by Cyberattack, Third LVMH Breach in 3 Months

Louis Vuitton UK suffers cyberattack exposing customer data, marking the third LVMH breach in 3 months as retail sector faces ongoing security threats...

Qantas Confirms Major Data Breach Linked to Third-Party Vendor

Qantas has confirmed a data breach after attackers gained access through a third-party call centre platform, affecting millions…...

Qantas: Breach affects 6 million people, “significant” amount of data likely taken

Australia's largest airline Qantas has confirmed that cybercriminals have gained access to a third party customer servicing platform that contained 6 million customer service records. Qantas says the breach occurred after a cybercriminal targeted a call centre and managed to gain access to the...