CVE-2025-10870 — SQL injection in DIAL's CentrosNet

CVE-2025-10870

SQL injection in DIAL's CentrosNet PUBLISHED

Description (CNA)

SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'.

Affected (CNA)

Vendor / product	Versions
DIAL / CentrosNet	affected prior to 2.65

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-dials-centrosnet

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.