CVE-2025-41377

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
TESIGandia Integra Total>= 2.1.2217.3, < 4.4.2236.1

References

Timeline

Published
May 23, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-413786.9The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker tCVE-2025-413796.3The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding CVE-2025-41387.5Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of somCVE-2025-413806.1Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve tCVE-2025-413846.1Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by CVE-2025-413857.2An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed byCVE-2025-413887.8Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.CVE-2025-41398.8A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInboundCVE-2025-413907.8An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repCVE-2025-413915.4Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitraryCVE-2025-413927.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper valiCVE-2025-413935.1Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image
CVE-2025-41377: High severity, CVSS 8.7 | Vulnix