{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UPDATE:\n\n\n\n\nFollowing the publication of these vulnerabilities and the subsequent CVE\nassignments, the CVE identifiers have now been revoked.\n\n\n\n\nThe vendor (EQS Group) contacted the CVE Program (via a CNA) and\u00a0disputed the\nrecords, stating that the affected product is an exclusively hosted SaaS\nplatform with no customer-managed deployment or versioning. Based on this\nargument, the CVE Program concluded that CVE assignment is \u201cnot a suitable\nsolution for vulnerability identification\u201d in this case, as customers do not\ntake direct action to apply fixes.\n\n\n\n\nIn other words, because the service is centrally hosted and patched at the\nprovider\u2019s discretion, the vulnerabilities are no longer considered eligible for\nCVE tracking, despite being real, independently discovered, responsibly\ndisclosed, and acknowledged by the vendor.\n\nThe vendor has stated that fixes are being implemented and that private customer\nnotifications will be issued internally.\n\n\n\n\nWhile remediation is of course welcome, this outcome highlights a broader issue:\nvulnerabilities in SaaS platforms can effectively disappear from public\nvulnerability tracking, simply because the deployment model removes user agency,\na model that arguably incentivizes security through obscurity, rather than\ntransparency.\n\n\n\n\nThe technical findings remain valid.\n\n\n\n\nThis update is shared purely for accuracy and record-keeping.\n\nOn Sun, Jan 4, 2026 at 4:40 PM \u003cyuffie.kisaragi () atomicmail io\n[yuffie.kisaragi () atomicmail io]\u003e wrote:\nUPDATE:\n\n\nThe reported vulnerabilities have now been assigned CVE identifiers:\nCVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411\n[https://www.cve.org/cverecord?id=CVE-2025-34411]\nCVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412\n[https://www.cve.org/cverecord?id=CVE-2025-34412]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/4"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34411"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34412"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0195",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4",
            "automated": true,
            "contentSha256": "f09c92da4c5a7aeb2581a72015cc49071ab139218b207121c182b6d3bc9d070c",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-04T22:01:57Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0195"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0195"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}