SQL Injection in Grupo Castilla Epsilon Rh
CVE-2025-41028
A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete database via sending a POST request using the parameter ‘sEstadoUsr’ in ‘/epsilonnetws/WSAvisos.asmx’.
Vulnerability class: SQL Injection
EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.
Affected products
- Grupo Castilla Epsilon Rh — versions 3.03.36.010