SQL injection in Zeon Academy Pro by Zeon Global Tech
Posted date 04/02/2026
Identificador
INCIBE-2026-295
Importance
5 - Critical
Affected Resources
Zeon Academy Pro
Description
INCIBE has coordinated the publication of a critical vulnerability affecting Zeon Academy Pro by Zeon Global Tech, a school management system. The vulnerability was discovered by Gonzalo Aguilar García (6h4ack).
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2025-41029: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
Solution
There is no solution reported at this time.
Detail
CVE-2025-41029: SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2025-41029 | Crítica | No | Zeon Global Tech |
References list
Etiquetas
