CVE-2025-40985 HIGH

CVE-2025-40985: SQL Injection in SCATI Vision Web

Vendor Scati
Product SCATI Vision Web
Weakness CWE-89 · SQLi
Published July 16, 2025
Last update July 16, 2025
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an attacker to exfiltrate some data from the database via the ‘login’ parameter in the endpoint ‘/scatevision_web/index.php/loginForm’.

Key dates

02Disclosure timeline

July 16, 2025 CVE published
July 16, 2025 Record updated