Vulnerability · Published Nov 25, 2025 · Assigned by GitHub_M

CVE-2025-65957Core Bot is Leaking Sensitive Credentials in Logs, Errors, and Messages

High 8.8

In plain English

A high-severity information exposure in Core-Bot from Intercore-Productions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using environment variables, but there are cases in code (error handling, summaries, webhooks) where configuration summaries may inadvertently leak sensitive data (e.g., by failing to redact data in summary embeds or logs). This issue has been patched via commit dffe050.

Affected products (as reported)

Vendor	Product	Versions
Intercore-Productions	Core-Bot	< dffe050d565a580edfcd0242efa45da88ab31260

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L

References

https://github.com/Intercore-Productions/Core-Bot/security/advisories/GHSA-42j6-x28v-38r8 x_refsource_CONFIRM
https://github.com/Intercore-Productions/Core-Bot/commit/dffe050d565a580edfcd0242efa45da88ab31260 x_refsource_MISC