Medium severity · published Oct 29, 2025
CVE-2025-12461
Unprotected access to parts of the application in Epsilon RH by Grupo Castilla
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which modules are installed.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Epsilon RH · Grupo Castilla
3.03.36.0185 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12461
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/unprotected-access-parts-application-epsilon-rh-grupo-castilla
More from Epsilon RH
9.3
CVE-2025-41028
SQL injection in Epsilon RH