Auth bypass in T-Innova Deporsite
CVE-2025-41031
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage’.
Vulnerability class: Broken Access Control
EPSS: 0.003 (23.0th percentile) — read the EPSS interpretation.
Affected products
- T-innova Deporsite — versions versions prior to v02.14.1115