PT-2025-42435

CVE-2025-41020

·

Published

2025-10-16

·

Updated

2025-10-21

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Sergestec Exito version 8.0
Description An insecure direct object reference (IDOR) issue exists in Sergestec Exito version 8.0. This allows an attacker to access data belonging to other customers. The issue is present in the /admin/ticket a4.php endpoint, specifically through manipulation of the id parameter.
Recommendations Restrict access to the /admin/ticket a4.php endpoint. Sanitize or validate the id parameter to ensure it corresponds to the authorized data.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-639: Authorization Bypass Through User-Controlled Key
Related identifiers
CVE-2025-41020
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com