CVE-2025-41008 - SQL Injection in Sinturno

Back Back to CVE browser

CRITICAL

SQL Injection in Sinturno

Published Mar 23, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.25%

Description

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint.

Affected products

Vendor Sinturno Product Sinturno Default
unaffected
- Version
  all versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sinturno

unaffected

Version	Status	Constraints
all versions	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-208935		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sinturno

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Mar 23, 2026

Updated Mar 23, 2026

Reserved Apr 16, 2025

Link CVE-2025-41008

CISA Vulnrichment

Updated Mar 23, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-41008

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-41008

ENISA EUVD

Assigner INCIBE

Published Mar 23, 2026

Updated Mar 23, 2026

Exploited since n/a

Link EUVD-2025-208935

EUVD-2025-208935