CVE-2025-62236
The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-204
- Published
- 2025-10-23
- Last modified
- 2026-03-12
Affected products
- Frontier Airlines flyfrontier.com
Weakness type
Related vulnerabilities
- CVE-2026-9161 — User Enumeration in DernekPlus' Website Template
- CVE-2026-86758 — Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- CVE-2026-19205 — User Enumeration in GastroMenum's GastroMenum Web Panel
- CVE-2026-19080 — Username Enumeration in Menulux Software's Menulux Portal
- CVE-2026-78584 — Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
- CVE-2026-84307 — Filament: Password validity disclosure for accounts denied panel access on login page
- CVE-2026-81033 — Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy
- CVE-2026-75575 — Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method