CVE-2025-40985 | THREATINT

Description

SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.

Reserved 2025-04-16 | Published 2025-07-16 | Updated 2025-07-16 | Assigner INCIBE

HIGH: 8.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

4.8

affected

Credits

Raúl Calvo Laorden finder

Álex Rodríguez Pérez finder

References

www.incibe.es/...otices/aviso/sql-injection-scati-vision-web

cve.org (CVE-2025-40985)

nvd.nist.gov (CVE-2025-40985)

Download JSON