Exito vulnerabilities

2 known vulnerabilities in Exito from Sergestec. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Exito: Authorization Bypass Through User-Controlled Key

  CVE-2025-41020Oct 16, 2025Sergestec

  Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.

• 9.8 Critical severity

  Exito: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-41018Oct 16, 2025Sergestec

  SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.