CVE-2025-40732 User enumeration vulnerability in Daily Expense Manager
Attackers can enumerate valid usernames by sending POST requests to check.php, exposing user account existence.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40732?
CVE-2025-40732 is a high-severity vulnerability in Daily Expense Manager, published on 30 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php
Weakness: CWE-203
Which versions are affected by CVE-2025-40732?
It affects 1 product.
Products include Code-Projects Daily Expense Manager.
How do I fix CVE-2025-40732?
No fix has been published for CVE-2025-40732 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40732 being exploited?
There is no known exploitation of CVE-2025-40732 in the wild and no public exploit code.
Other vulnerabilities in Daily Expense Manager
Sources
Also known as GHSA-76wp-r6xr-9rx6.