CVE-2025-41020

HighCVSS 7.5

Published: 16/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.

Risk Assessment

An attacker can access data belonging to other customers, potentially leading to confidentiality breaches and unauthorized information disclosure.

Recommendation

Update Exito to a version containing the fix. Implement server-side object-level authorization checks for the 'id' parameter.

Other vulnerabilities in Exito

CVE-2025-41018Critical
SQL injection vulnerability in Sergestec Exito v8.0. It allows an attacker to retrieve, create, update, and delete databases via the 'cat' parameter in '/public.php'.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS