VULNERABILITY INTELLIGENCE
CVE-2025-41358
EPSS probability0.34%
CISA KEVNot currently listed
Published2025-12-10
Last modified2026-09-25
Description
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.
Weakness classification
- cve-coordination@incibe.es: CWE-639