CVE-2025-1395
Published: 30 January 2026
Summary
CVE-2025-1395 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Gov (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-1395 is a Generation of Error Message Containing Sensitive Information vulnerability (CWE-209) in HeyGarson, a product from Codriapp Innovation and Software Technologies Inc. The flaw enables fuzzing for application mapping by leaking sensitive details through error messages. It affects all versions of HeyGarson through 30012026. The vulnerability received a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and lack of required privileges or user interaction.
Remote, unauthenticated attackers can exploit this vulnerability over the network by sending crafted fuzzing inputs to the affected HeyGarson application. Successful exploitation allows attackers to map the application's structure and extract sensitive information from error responses, achieving high confidentiality impact through information disclosure and low integrity impact, potentially aiding further attacks like reconnaissance for targeted exploits.
The primary advisory is available at https://www.usom.gov.tr/bildirim/tr-26-0009. No patches or vendor fixes are confirmed, as the vendor was contacted multiple times to verify the fixing process but did not respond. Security practitioners should isolate or discontinue use of affected HeyGarson instances until further mitigation details emerge.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206579
Vulnerability details
Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping. This issue affects HeyGarson: through 30012026. NOTE: The vendor was contacted several times to verifying fixing process but did…
more
not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables remote info disclosure via error messages for app mapping/recon (T1592) on a public-facing app (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-11 requires effective error handling that prevents the generation of error messages containing sensitive information, directly mitigating the disclosure enabling application mapping via fuzzing.
SI-15 mandates filtering of sensitive information prior to output to external systems, blocking the leakage of application details in error responses to crafted fuzzing inputs.
AU-13 enables monitoring for events indicating information disclosure, such as sensitive data appearing in error messages during fuzzing attempts.