CVE-2025-41028: Grupo Castilla Epsilon Rh

Critical severity, CVSS 9.3. EPSS: 0.5% chance of exploitation in the next 30 days.

A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete database via sending a POST request using the parameter ‘sEstadoUsr’ in ‘/epsilonnetws/WSAvisos.asmx’.

Affected products

• Grupo Castilla Epsilon Rh: version 3.03.36.010 only

Published 2025-10-20. Last modified 2026-10-08.