Security Advisory

CVE-2025-40635

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-05-20 12:51:57

Last updated 2025-05-21 11:17:30

Assigner INCIBE

State PUBLISHED

Description

SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘uidActivity’, ‘codCompany’ and ‘uidInstance’ parameters of the ‘/comerzzia/login’ endpoint.

← Browse all CVEs View on cve.org ↗