{"id":"CVE-2025-40985","state":"PUBLISHED","title":"SQL Injection in SCATI Vision Web","description":"SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.","publishedAt":"2025-07-16T09:27:41.306Z","updatedAt":"2025-07-16T14:40:05.100Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["SCATI SCATI Vision Web"],"affected":[{"vendor":"SCATI","product":"SCATI Vision Web","defaultStatus":"unaffected","versions":[{"version":"4.8","status":"affected","lessThanOrEqual":"7.2","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-scati-vision-web"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40985.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-40985","state":"PUBLISHED","datePublished":"2025-07-16T09:27:41.306Z","dateUpdated":"2025-07-16T14:40:05.100Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2025-04-16T09:08:37.855Z"},"containers":{"cna":{"title":"SQL Injection in SCATI Vision Web","descriptions":[{"lang":"en","value":"SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’."}],"affected":[{"vendor":"SCATI","product":"SCATI Vision Web","defaultStatus":"unaffected","versions":[{"version":"4.8","status":"affected","lessThanOrEqual":"7.2","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-scati-vision-web"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.3,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2025-07-16T09:27:41.306Z"},"credits":[{"lang":"en","type":"finder","value":"Raúl Calvo Laorden"},{"lang":"en","type":"finder","value":"Álex Rodríguez Pérez"}],"datePublic":"2025-07-15T10:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The vulnerability has been fixed by the SCATI Vision team in version 7.3.1.0."}],"value":"The vulnerability has been fixed by the SCATI Vision team in version 7.3.1.0."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-16T14:33:44.142595Z","id":"CVE-2025-40985","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-16T14:40:05.100Z"}}]}}}