Description
TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
References
www.rocketsoftware.com/...ration/rocket-trufusion-enterprise
www.rcesecurity.com/...nerabilities-in-trufusion-enterprise/
github.com/...advisories/blob/master/CVEs/CVE-2025-27225.txt
