Vulnerability · Published Sep 18, 2025 · Assigned by INCIBE

CVE-2025-40677SQL injection vulnerability in Summar Software´s Portal del Empleado

High 8.7

In plain English

A high-severity SQL injection in Portal del Empleado from Summar Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.6%top 48.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

Affected products (as reported)

Vendor	Product	Versions
Summar Software	Portal del Empleado	3.98.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portal