CVE-2025-40985

SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.

Score

CVSS 4.0 8.3 High

Status

Deferred - cve-coordination@incibe.es

Published

2025-07-16

Last modified

2025-07-16

Weaknesses

CWE-89

Affected products

• Scati Vision Web (Scati)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-scati-vision-web