CVE-2025-9977
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-89
Neutralización incorrecta de elementos especiales usados en un comando SQL (Inyección SQL)
Fecha de publicación:
18/11/2025
Última modificación:
18/11/2025
Descripción
*** Pendiente de traducción *** Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthenticated attacker to perform DoS attacks. SQL injection attacks might also be feasible, although so far creating a working exploit has been prevented probably by backend filtering mechanisms.<br />
Additionally, command injection attempts cause the application to return extensive error messages disclosing some information about the internal infrastructure. <br />
Patching status is unknown because the vendor has not replied to messages sent by the CNA.
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA