CVE-2025-11025 Information Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform
Attackers can retrieve embedded sensitive data from sent messages in the Vimesoft Corporate Messaging Platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-11025?
CVE-2025-11025 is a medium-severity vulnerability in Vimesoft Corporate Messaging Platform, published on 26 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data.
This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.
Weakness: CWE-201
Which versions are affected by CVE-2025-11025?
How do I fix CVE-2025-11025?
No fix has been published for CVE-2025-11025 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11025 being exploited?
There is no known exploitation of CVE-2025-11025 in the wild and no public exploit code.
Sources
Also known as GHSA-88x5-25pm-735m.