CVE-2025-40698CWE-89sql-injection

CVE-2025-40698

published September 25, 2025

CVSS
8.7
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-25T16:15Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-prevengos-nedatec-consulting · [email protected]
EPSS history
Timeline
  • 25 SEP 11:15Z
    SQL injection vulnerability in Prevengos
    cvelistv5