high8.7Public exploit code
CVE-2025-40677
SQL injection vulnerability in Summar Software´s Portal del Empleado.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Summar Employee Portal 3.98.0 - Authenticated SQL Injection2025-12-16 · webapps · multiple
Impact
SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.