{"id":"EUVD-2025-177193","enisaUuid":"0498ddae-5c22-3b48-b437-4bac34a7e11e","description":"Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.","datePublished":"Nov 13, 2025, 9:29:44 PM","dateUpdated":"Nov 13, 2025, 9:39:43 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh\nhttps://github.com/directus/directus/commit/7737d56e096f95edfbdf861a3c08999ad31ce204\n","aliases":"CVE-2025-64748\nGHSA-8jpw-gpr4-8cmh\nMAL-2025-188687\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"06a6777a-d33c-3385-9e28-6706813303b2","product":{"name":"directus","vendor":{"name":"directus"}},"product_version":"\u003c 11.13.0"}],"enisaIdVendor":[{"id":"887eb8f9-106d-3a02-85b4-51a57ba061df","vendor":{"name":"directus"}}],"enisaIdVulnerability":[{"id":"85d3ebd6-8e51-3e01-9569-695bbec98851","vulnerability":{"id":"CVE-2025-64748","description":"Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.","datePublished":"Nov 13, 2025, 9:29:44 PM","dateUpdated":"Nov 13, 2025, 9:39:43 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh\nhttps://github.com/directus/directus/commit/7737d56e096f95edfbdf861a3c08999ad31ce204\n","enisa_id":"EUVD-2025-177193\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 29, 2026, 7:20:03 AM","vulnerabilityProduct":[{"id":"a84bffec-d2f2-3ba7-a53b-ef5a59b2b8b0","product":{"name":"directus","vendor":{"name":"directus"}},"product_version":"\u003c 11.13.0"}],"vulnerabilityVendor":[{"id":"fcbac5b8-242f-38b9-aed7-5c04bdb4b740","vendor":{"name":"directus"}}]}},{"id":"d57417af-1eed-3aec-9b1e-099e913cca85","vulnerability":{"id":"GHSA-8jpw-gpr4-8cmh","description":"Directus\u0027s conceal fields are searchable if read permissions enabled","datePublished":"Nov 13, 2025, 11:06:41 PM","dateUpdated":"Nov 15, 2025, 3:15:27 AM","baseScore":0.0,"references":"https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64748\nhttps://github.com/directus/directus/commit/7737d56e096f95edfbdf861a3c08999ad31ce204\nhttps://github.com/directus/directus\n","enisa_id":"EUVD-2025-177193\n","aliases":"GHSA-8jpw-gpr4-8cmh\nCVE-2025-64748\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f3f52692-b125-34c8-9ea2-c2f9c590ab12","vulnerability":{"id":"MAL-2025-188687","description":"Malicious code in photon-darkenergy-mocha-terraforming (npm)","datePublished":"Nov 13, 2025, 3:23:14 AM","dateUpdated":"Nov 13, 2025, 3:23:14 AM","baseScore":0.0,"enisa_id":"EUVD-2025-177193\n","epss":0.0,"dataProcessed":"Nov 14, 2025, 1:06:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}