The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.

The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.

CONPROSYS HMI System (CHS) provided by Contec Co.,Ltd. contains multiple vulnerabilities listed below. * Reflected cross-site scripting (CWE-79) - CVE-2025-34080 * Insertion of sensitive information into debugging code (CWE-215) - CVE-2025-34081 Alex Williams of Converge Technology Solutions reported these vulnerabilities to Vulncheck Inc., and Vulncheck Inc. reported these vulnerabilities to the developer. Based on the coordination request made by the developer, JPCERT/CC coordinated with Vulncheck Inc. and the developer.