First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-40617

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Bookgy	Bookgy	all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgyThird Party Advisory

Timeline

Published: Apr 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-406189.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendin CVE-2025-406197.5Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor CVE-2025-40627.8A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability i CVE-2025-406209.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del CVE-2025-406219.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del CVE-2025-406229.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del CVE-2025-406239.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del CVE-2025-406249.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del CVE-2025-406259.8Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, eve CVE-2025-406266.1Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim CVE-2025-406276.1Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim CVE-2025-406289.3SQL injection vulnerability in DomainsPRO 1.2. This vulnerability could allow an attacker to retrieve, create, update and delete databases v

CVE-2025-40617: Critical severity, CVSS 9.8 | Vulnix