PT-2026-2264 · Master · Mems Events Crm

CVE-2025-41005 · Publicado 2026-01-12 · Atualizado 2026-01-12

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Imaster's MEMS Events CRM (affected versions not specified)

Description The software contains an SQL injection issue in the keyword parameter of the '/memsdemo/exchange offers.php' API endpoint. This allows for potential unauthorized database access or modification.

Recommendations Sanitize or validate the keyword parameter in the '/memsdemo/exchange offers.php' endpoint to prevent SQL injection attacks.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-41005

Produtos afetados

Mems Events Crm

Referências · 3

• https://twitter.com/CVEnew/status/2010733958380593427 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-41005 · Nota de Segurança
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products · Nota