CVE-2025-40698: Nedatec Consulting Prevengos

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in “/servicios/autorizaciones.asmx/mfsRecuperarListado”.

Affected products

• Nedatec Consulting Prevengos: before 2.48 (fixed in 2.48)

Published 2025-09-25. Last modified 2026-06-17.