SQL Injection in Scati Vision Web
CVE-2025-40985
SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.
Vulnerability class: SQL Injection
EPSS: 0.003 (25.8th percentile) — read the EPSS interpretation.
Affected products
- Scati Vision Web — versions 4.8