Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck
CVE-2025-34413Legality WHISTLEBLOWING Missing Critical HTTP Security Headers
High 7.1
In plain English
A high-severity security flaw in Legality WHISTLEBLOWING from DigitalPA S.r.l.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy (with CSP delivered via HTML meta elements being inadequate). The absence of these headers weakens browser-side defenses and increases exposure to client-side attacks such as cross-site scripting, clickjacking, referer leakage, and cross-origin data disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DigitalPA S.r.l. | Legality WHISTLEBLOWING | 0 |
Weakness: CWE-693 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://seclists.org/fulldisclosure/2025/Dec/0 technical-description, exploit
- https://www.digitalpa.net/en/whistleblowing-software-features/ product
- https://www.vulncheck.com/advisories/legality-whisteblowing-missing-critical-http-security-headers third-party-advisory