CVE-2025-40678

MEDIUM

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-40678 has a selected CVSS score of 5.3 (medium).

Description

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Portal del Empleado

Browse Summar Software / Portal del Empleado

Default status: unaffected

CVE List3.98.0affected

References

2