nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-9619 CVE-2025-9619
MEDIUM
E4 Sistemas Mercatus ERP id resource injection
Record summary
CVE-2025-9619 has a selected CVSS score of 6.9 (medium).
Description
A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-danfe/id/. Performing manipulation results in improper control of resource identifiers. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 29, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Mercatus ERPBrowse E4 Sistemas / Mercatus ERP | CVE List | 2.00.019 | affected |
References
4VDB-321790 | CTI Indicators (IOB, IOC, IOA)signaturepermissions required
https://vuldb.com/?ctiid.321790 VDB-321790 | E4 Sistemas Mercatus ERP id resource injectionvdb entry
https://vuldb.com/?id.321790 Submit #636623 | e4sistemas Mercatus ERP v 2.00.019 Insecure Direct Object Reference (IDOR)Third-party advisory
https://vuldb.com/?submit.636623