CVE-2025-40635

CVE-2025-40635 affects Comerzzia Backoffice: Sales Orchestrator 3.0.15. A SQL injection in /comerzzia/login via uidActivity, codCompany, and uidInstance can expose full database access (retrieve, create, update, delete). Base score 9.3 (CRITICAL) per CVSS v4.0; network attack, no authentication, ...