PT-2026-2264 · Master · Mems Events Crm

Published 2026-01-12 · Updated 2026-01-12 · CVE-2025-41005

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Imaster's MEMS Events CRM (affected versions not specified)

Description The software contains an SQL injection issue in the keyword parameter of the '/memsdemo/exchange offers.php' API endpoint. This allows for potential unauthorized database access or modification.

Recommendations Sanitize or validate the keyword parameter in the '/memsdemo/exchange offers.php' endpoint to prevent SQL injection attacks.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-41005

Affected Products

Mems Events Crm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-41005 · Security Note
• https://twitter.com/CVEnew/status/2010733958380593427 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-imaster-products · Note