SQL Injection in Summar Software Portal Del Empleado
CVE-2025-40677
SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
Vulnerability class: SQL Injection
EPSS: 0.006 (45.3th percentile) — read the EPSS interpretation.
Affected products
- Summar Software Portal Del Empleado — versions 3.98.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-40677?
- CVE-2025-40677 is a vulnerability in Summar Software Portal Del Empleado, classified under SQL Injection. Published 2025-09-18.
- Is CVE-2025-40677 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.