CVE-2025-40617: Bookgy

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

Affected products

• Bookgy Bookgy: affected versions not specified

Published 2025-04-29. Last modified 2026-06-17.