CVE-2025-40617

bookgy vulnerability - bookgy

Critical CVSS Score: 9.8 Published: 2025-04-29

Description

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

Affected Systems

Vendor bookgy
Product bookgy
Affected Versions -
CWE ID CWE-89

Mitigation

Apply the latest security patches from the vendor, restrict network exposure where applicable, and monitor for exploitation attempts.

Fix Instructions

Refer to the vendor advisory and apply the latest security updates. See references for detailed patching instructions.

References

Risk Assessment

CVSS: 9.8/10

Exploit Available Unknown
Patch Available Unknown

Need Help Patching?

Our security team can help assess and remediate this vulnerability in your environment.

Get Help

Related Vulnerabilities

critical

CVE-2025-40618

bookgy...

Stay Ahead of Threats

Subscribe to our vulnerability feed and get instant alerts when new CVEs affect your systems.

Start Monitoring