SQL Injection in Innovación Y Cualificación Ajax.php Plugin
CVE-2025-2199
SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’, ‘searchSpecialitiesLinked’, ‘searchUsersToUpdateProfile’, ‘training_action_data’, ‘showContinuingTrainingCourses’ and ‘showUsersToEdit’ in /local/administration/ajax.php.
Vulnerability class: SQL Injection
EPSS: 0.003 (24.5th percentile) — read the EPSS interpretation.
Affected products
- Innovación Y Cualificación Ajax.php Plugin — versions all versions
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-2199?
- CVE-2025-2199 is a vulnerability in Innovación Y Cualificación Ajax.php Plugin, classified under SQL Injection. Published 2025-03-17.
- Is CVE-2025-2199 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.