CVE-2025-41370

critical · 9.3

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php.

9.3

CVSS

0.6%

EPSS (exploit prob.)

47th

EPSS percentile

2025-08-01

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
tesigandia	gandia_integra_total	>= 2.1.2217.3, <= 4.4.2236.1

Check a specific version with /api/v1/cve/match.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-41370