CVE-2025-58581
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
Risk Assessment
The risk includes disclosure of sensitive application information, which could facilitate further attacks.
Recommendation
It is recommended to configure the application to not display full stack traces to users, but only generic error messages.
Other vulnerabilities in Unknown application
See all- CVE-2026-50208Critical
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
- CVE-2026-14953Medium
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
Original NVD description (English source)
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS