Sergestec vulnerabilities
We track 3 vulnerabilities in Sergestec products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2025.
Latest Sergestec vulnerabilities
- 7.5 High severity
Exito: Authorization Bypass Through User-Controlled Key
Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.
- 9.3 Critical severity
SISTICK: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'.
- 9.8 Critical severity
Exito: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.