Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promo_send' parameter in the '/assets/php/calculate_discount.php'.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
⚠️ #INCIBEaviso | Múltiples vulnerabilidades en #Eventobot #CVE CVE-2025-40638 y CVE-2025-40639 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-eventobot #AvisosDeSeguridad #TI #CNA #0day
Post summary
The tweet announces the existence of multiple CVEs in Eventobot but provides no additional technical or actionable information.
CVE-2025-40639 A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promo_s… https://www.cve.org/CVERecord?id=CVE-2025-40639
Post summary
CVE-2025-40639 is a disclosed SQL injection flaw in Eventobot that allows attackers to perform full CRUD operations on databases via the promo_s interface.
CVE-2025-40639 SQL Injection in Eventobot 'promo_send' Parameter Enables Database Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-40639
Post summary
The post announces a SQL injection vulnerability in Eventobot’s 'promo_send' parameter that enables database manipulation, but provides no details on PoC, exploit code, active use, or mitigations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sbitsoft | eventobot | - | - | - |