CVE-2025-41342
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_user' parameter to '/backend/api/buscarUsuarioId.php'.
Risk Assessment
Unauthorized access to user data by identifier may lead to leakage of personal and confidential information.
Recommendation
Implement authorization checks in the buscarUsuarioId.php endpoint and prevent retrieval of other users' data.
Other vulnerabilities in CanalDenuncia.app
See all- CVE-2025-41345High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST request with the parameters 'id_denuncia' and 'id_user' to '/backend/api/buscarDenunciasById.php'.
- CVE-2025-41344High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_archivo' parameter to '/backend/api/verArchivo.php'.
- CVE-2025-41343High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'email' parameter to '/backend/api/users/searchUserByEmail.php'.
- CVE-2025-41341High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'seguro' parameters to '/backend/api/buscarUsuarioByDenuncia.php'.
- CVE-2025-41340High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_tp_denuncia' and 'id_sociedad' parameters to '/backend/api/buscarTipoDenunciabyId.php'.
- CVE-2025-41339High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_sociedad' parameter to '/backend/api/buscarTipoDenuncia.php'.
- CVE-2025-41338High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'id_user' parameters to '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
- CVE-2025-41337High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
- CVE-2025-41336High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'.
- CVE-2025-41335High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id' and 'id_sociedad' parameters to '/api/buscarEmpresaById.php'.
Original NVD description (English source)
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_user' in '/backend/api/buscarUsuarioId.php'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS