PT-2025-39362 · Nedatec Consulting · Prevengos

Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-40698

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Prevengos version 2.44

Description A SQL injection issue exists in Prevengos version 2.44 by Nedatec Consulting. This allows an attacker to retrieve, create, update, and delete databases. The issue is triggered by sending a POST request to the /servicios/autorizaciones.asmx/mfsRecuperarListado API endpoint, utilizing the mpsCentroin, mpsEmpresa, mpsProyecto, and mpsContrata parameters.

Recommendations Apply a fix for Prevengos version 2.44 to address the SQL injection issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-40698

Affected Products

Prevengos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40698 · Security Note
• https://twitter.com/CveFindCom/status/1971177625633570932 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971194753409568793 · Twitter Post
• https://t.me/cveNotify/136378 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-prevengos-nedatec-consulting · Note
• https://twitter.com/CVEnew/status/1971175019540545970 · Twitter Post