Low severity · published Nov 24, 2025
CVE-2025-13596
Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client. This may expose internal filesystem paths, SQL queries, database connection details, or environment configuration data to remote unauthenticated attackers. This issue allows information gathering and reconnaissance but does not enable direct system compromise.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
CIGES · ATISoluciones
2.15.0 before 2.15.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13596
www.atisoluciones.com
https://www.atisoluciones.com/incidentes-cve
More from CIGES
7.5
CVE-2024-2725
Information exposure vulnerability in the CIGESv2 system
7.5
CVE-2024-2724
SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter
7.5
CVE-2024-2723
SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter
7.5
CVE-2024-2722
SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter
6.1
CVE-2024-2727
HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message