CVE-2025-40715: SQL injection vulnerability in Quiter Gateway

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo mensaje in /QISClient/api/v1/sucesospaginas.

Affected products

Quiter Gateway (Java WAR on Apache Tomcat): before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: Quiter Gateway (Java WAR on Apache Tomcat) 4.7.0. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-quiterweb-autoweb-quiter

Get alerted when CVE-2025-40715 or the next vulnerability affects your stack