CVE-2025-27225
High · 7.5CVSS
7.5
EPSS
18.4%
Published
Oct 27, 2025
CISA due date
—
The record
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|