Salesforce tags 5 CVEs after SaaS security probe uncovers misconfig risks

Salesforce has assigned five CVE identifiers following a security report that uncovered more than 20 configuration weaknesses, some of which exposed customers to unauthorized access and session hijacking.

The vulnerabilities were made public this week after admins were notified of the flaws in May. Aaron Costello, AppOmni chief of SaaS security research who made the findings, said all five CVEs were associated with Flexcards, Data Mappers, and other core components of Salesforce Industries.

https://www.theregister.com/2025/06/11/salesforce_cves_misconfigs/