High severity · published Jun 10, 2025
CVE-2025-40661
Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/selection.asp.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DM Corporative CMS · Dmacroweb
before 2025.01 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40661
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40661
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
More from DM Corporative CMS
9.8
CVE-2025-40657
SQL injection vulnerability in DM Corporative CMS
9.8
CVE-2025-40656
SQL injection vulnerability in DM Corporative CMS
9.8
CVE-2025-40655
SQL injection vulnerability in DM Corporative CMS
9.8
CVE-2025-40654
SQL injection vulnerability in DM Corporative CMS
7.5
CVE-2025-40662
Absolute path disclosure vulnerability in DM Corporative CMS