CVE-2025-3574: T-Innova Deporsite

High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint.

Affected products

• T-Innova Deporsite: version v05.29.0907 only

Published 2025-04-15. Last modified 2026-06-17.