CVE-2025-41370CWE-89

SQL injection vulnerability in Gandia Integra Total

Critical · published August 1, 2025

CVSS v4.0

9.3

EPSS

Percentile

50.6

In the wild

Unconfirmed

What it is

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php.

The record

Technical detail

CVSS v4.0: 9.3 · CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00651 · 50.6th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-08-01T12:28Z

EPSS history

Timeline

01 AUG 12:28Z
SQL injection vulnerability in Gandia Integra Total
cvelistv5