How severe is CVE-2025-32789?

This vulnerability has a severity rating of LOW with a CVSS score of 3.1 out of 10.

What type of vulnerability is CVE-2025-32789?

This is classified as CWE-200, which is a common weakness in software security.

CVE-2025-32789 - LOW Severity | CVSS 3.1

Vulnerability Description

EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of the sorted list of users. Although unlikely, if an attacker knows the hash value of their password, they can change the password and repeat the sorting until the other user's password hash is fully revealed. This issue is patched in version 9.0.7.

Related Vulnerabilities

CVE-2015-4078

LOW

CVSS:3.1(Low)

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data vi...

CWE-2002015

CVE-2015-5070

LOW

CVSS:3.1(Low)

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensi...

CWE-2002015

CVE-2015-6641

LOW

CVSS:3.1(Low)

Bluetooth in Android 6.0 before 2016-01-01 allows remote attackers to obtain sensitive Contacts information by leveraging pairing, aka internal bug 23607427.

CWE-2002015

CVE-2015-8481

LOW

CVSS:3.1(Low)

Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup re...

CWE-2002015

CVE-2016-0125

LOW

CVSS:3.1(Low)

Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Di...

CWE-2002016

CVE-2016-1500

LOW

CVSS:3.1(Low)

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, w...

CWE-2002016