CVE-2025-41009CWE-89sql-injection

CVE-2025-41009

published October 27, 2025

CVSS
9.3
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-27T16:15Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-virtual-campus-platform-diseno-de-recursos-educativos · [email protected]
EPSS history
Timeline
  • 27 OCT 11:35Z
    SQL injection on the virtual campus platform of Diseño de Recursos Educativos
    cvelistv5