CVE Intelligence

CronosWeb i2A vulnerabilities

🔔 Create alert RSS

Published CVEs affecting CronosWeb i2A products: 1 record(s), with severity, exploitation and fixes.

CronosWeb 1

Exploited only (KEV) →

CVE-2025-41358 High · 8.3 CWE-639 Dec 10, 2025
Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.