CVE-2025-41373
SQL injection vulnerability in Gandia Integra Total
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Popular PoC on GitHub (2 stars) — exploitation code widely available.
CVSS 8.7EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
01 Aug 2025Published on NVD
01 Aug 2025Public PoC
Weaponization speed
same dayto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
TESI · Gandia Integra Totalpublic PoCs found — 2
githubgithub.com/byteReaper77/CVE-2025-41373★ 2exploitdbwww.exploit-db.com/exploits/52388unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.