CVE-2025-40698 — SQL injection vulnerability in Prevengos

CVE-2025-40698

SQL injection vulnerability in Prevengos PUBLISHED

Description (CNA)

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”.

Affected (CNA)

Vendor / product	Versions
Nedatec Consulting / Prevengos	affected 0 before 2.48

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-prevengos-nedatec-consulting

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.