CVE-2025-41031 — Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parame…
Published: 2025-09-02 · CVSS: 6.9 · CVSS 4.0
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage’.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7