Medium severityNVD Advisory· Published Sep 18, 2025· Updated Apr 15, 2026

CVE-2025-40678

Description

Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Summar Software/Portal del Empleadollm-create

Patches

Vulnerability mechanics

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portalnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000