CVE-2025-40728

8.7 highEPSS 0.5%

High (8.7) in oretnom23 customer support system. EPSS 0.5% chance of exploitation in the next 30 days.

SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2025-06-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oretnom23:customer_support_system

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system

Check your stack JSON