SQL Injection Flaw in Sergestec's Exito Version 8.0
CVE-2025-41018

9.3CRITICAL

Key Information:

Vendor

Sergestec

Status
Exito
Vendor
CVE Published:
16 October 2025

What is CVE-2025-41018?

An SQL injection vulnerability has been identified in Sergestec's Exito version 8.0 that allows attackers to manipulate database content via the 'cat' parameter in the '/public.php' endpoint. This security flaw could enable unauthorized users to perform a range of operations, including retrieval, creation, updating, and deletion of database entries, posing a significant threat to data integrity and confidentiality.

Affected Version(s)

Exito 8.0

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ignacio Aldarabi
JSON
.
CVE-2025-41018 : SQL Injection Flaw in Sergestec's Exito Version 8.0