What’s Vulnerable › Vulnerabilities
CVE-2025-41358: Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A
- Severity: high (CVSS 8.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-10 · updated 2026-09-25
- Weakness: CWE-639
Description
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.
Affected products
- CronosWeb i2A CronosWeb: 25.00 and 24.05.
References
Get alerted when CVE-2025-41358 or the next vulnerability affects your stack