CVE-2025-40617

critical · 9.3

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

9.3

CVSS

0.4%

EPSS (exploit prob.)

33rd

EPSS percentile

2025-04-29

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
bookgy	bookgy	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-40617