{"id":"CVE-2025-40698","title":"SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting","summary":"SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mp…","severity":"none","cwe":["CWE-89"],"published":"2025-09-25","updated":"2026-10-11","sourceUpdated":"2026-10-11T20:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-40698","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-prevengos-nedatec-consulting","label":"cve-coordination@incibe.es"}],"tags":["nvd"],"epss":0.00259,"epssPercentile":0.16228,"ingestedAt":"2026-10-12T14:50:33.987Z","slug":"CVE-2025-40698","body":"## Overview\n\nSQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}