Skip to content
OpenAdvisories
Critical · 9.3 CVE-2025-40618 EUVD-2025-12640GHSA-phfx-9rhx-m3x9

SQL injection vulnerability in Bookgy

Published Apr 29, 2025 · Updated Apr 29, 2025 · Assigned by INCIBE

Description

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA"  parameter in /bkg_imprimir_comprobante.php

Affected products

VendorProductAffectedFixed
Bookgy Bookgy all versions —

References