Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-41019

SQL injection vulnerability in Sergestec's Exito

SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sergestec
Products
Systick
CVE-2025-41018

SQL injection vulnerability in Sergestec's Exito

SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Sergestec
Products
Exito
CVE-2025-41020

Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito

Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sergestec
Products
Exito
CVE-2025-41021

Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito

Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' parameter in '/admin/index.php?action=product_update'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sergestec
Products
Exito