CVE-2025-27225

HIGH · 7.5 CVSS Gepubliceerd: 27-10-2025 CWE-200

Beschrijving

TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.

Vendors

Rocketsoftware

Affected products

Trufusion Enterprise

References

github.com
www.rcesecurity.com
www.rocketsoftware.com