CVE-2025-41377

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.

Score

CVSS 4.0 8.7 High

Status

Deferred - cve-coordination@incibe.es

Published

2025-05-23

Last modified

2025-08-01

Weaknesses

CWE-89

Affected products

• Gandia Integra Total (Tesi)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi