CVE-2025-41018

CriticalCVSS 9.8

Published: 16/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

SQL injection vulnerability in Sergestec Exito v8.0. It allows an attacker to retrieve, create, update, and delete databases via the 'cat' parameter in '/public.php'.

Risk Assessment

An attacker can gain full access to databases, potentially leading to data loss, integrity and confidentiality breaches.

Recommendation

Immediately apply patches or restrict access to the vulnerable endpoint, and use parameterized queries.

Other vulnerabilities in Exito

CVE-2025-41020High
Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.

Original NVD description (English source)

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS