CVE-2025-1395

High

Published: 30 January 2026

Published

30 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0002 4.0th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1395 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Gov (inferred from references). Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-11 Error Handling good match

prevent

SI-11 requires effective error handling that prevents the generation of error messages containing sensitive information, directly mitigating the disclosure enabling application mapping via fuzzing.

SI-15 Information Output Filtering good match

prevent

SI-15 mandates filtering of sensitive information prior to output to external systems, blocking the leakage of application details in error responses to crafted fuzzing inputs.

AU-13 Monitoring for Information Disclosure partial match

detect

AU-13 enables monitoring for events indicating information disclosure, such as sensitive data appearing in error messages during fuzzing attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1592 Gather Victim Host Information Reconnaissance

Adversaries may gather information about the victim's hosts that can be used during targeting.

attack.mitre.org →

Why these techniques?

Vuln enables remote info disclosure via error messages for app mapping/recon (T1592) on a public-facing app (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping.This issue affects HeyGarson: through 30012026. NOTE: The vendor was contacted several times to verifying fixing process but did not…

respond in any way.

Deeper analysisAI

CVE-2025-1395 is a Generation of Error Message Containing Sensitive Information vulnerability (CWE-209) in HeyGarson, a product from Codriapp Innovation and Software Technologies Inc. The flaw enables fuzzing for application mapping by leaking sensitive details through error messages. It affects all versions of HeyGarson through 30012026. The vulnerability received a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.

Remote, unauthenticated attackers can exploit this vulnerability over the network by sending crafted fuzzing inputs to the affected HeyGarson application. Successful exploitation allows attackers to map the application's structure and extract sensitive information from error responses, achieving high confidentiality impact through information disclosure and low integrity impact, potentially aiding further attacks like reconnaissance for targeted exploits.

The primary advisory is available at https://www.usom.gov.tr/bildirim/tr-26-0009. No patches or vendor fixes are confirmed, as the vendor was contacted multiple times to verify the fixing process but did not respond. Security practitioners should isolate or discontinue use of affected HeyGarson instances until further mitigation details emerge.