# CVE-2025-1030: Utarit SoliClub information exposure in query system

Source: https://junglewise.ai/threats/cve-2025-1030-utarit-soliclub-information-exposure-in-query-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-18. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2025-1030 · Severity: high · CVSS 7.5 · Published 2025-12-18

A vulnerability in the SoliClub application allows unauthorized individuals to access private personal information. SoliClub is a platform used for campus and corporate services such as payments and access control. An exploit could lead to the large-scale exposure of sensitive user data, potentially resulting in privacy violations and identity theft risks for affected individuals.

Technologies: [Utarit Soliclub](https://junglewise.ai/threats/technologies/soliclub). Vendors: [Utarit](https://junglewise.ai/threats/vendors/utarit).

## Quick answers

**Is CVE-2025-1030 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-1030 being exploited in the wild.

**How severe is CVE-2025-1030?** High severity, with a CVSS score of 7.5, published 18 December 2025.

**Which products and versions are affected?** Utarit Informatics Services Inc. SoliClub from 5.2.4 before 5.3.7.

**Is there a fix for CVE-2025-1030?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-1030 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-1030?** Check whether you run Utarit Soliclub. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Information Exposure vulnerability (CWE-359) exists in Utarit Informatics Services Inc. SoliClub versions 5.2.4 through 5.3.6. The flaw resides in the application's query system, which fails to properly restrict access to sensitive data. A remote, unauthenticated attacker can exploit this over the network to retrieve private personal information without authorization. The vulnerability was addressed in version 5.3.7.

## Affected products

- Utarit Informatics Services Inc. SoliClub from 5.2.4 before 5.3.7

## Timeline

- 2025-12-18: disclosed
- 2025-12-18: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0466)
- [https://www.usom.gov.tr/bildirim/tr-25-0466](https://www.usom.gov.tr/bildirim/tr-25-0466)

## Related threats

- [Utarit SoliClub hard-coded credentials allow authentication abuse](https://junglewise.ai/threats/cve-2025-7358-utarit-soliclub-hard-coded-credentials-allow-authentication-abuse)
- [Utarit Informatics Services SoliClub missing authorization](https://junglewise.ai/threats/cve-2025-7047-utarit-informatics-services-soliclub-missing-authorization)
- [Utarit SoliClub authorization bypass via user-controlled key](https://junglewise.ai/threats/cve-2025-1031-utarit-soliclub-authorization-bypass-via-user-controlled-key)
- [Utarit SoliClub hard-coded credentials in executable](https://junglewise.ai/threats/cve-2025-1029-utarit-soliclub-hard-coded-credentials-in-executable)