CVE-2025-41008CWE-89

SQL Injection in Sinturno

Critical · published March 23, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00237 · 13.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-23T12:59Z
EPSS history
Timeline
  • 23 MAR 12:59Z
    SQL Injection in Sinturno
    cvelistv5