CVE-2019-25674

CMSsite 1.0 SQL Injection via post Parameter

High8.8EPSS 0.42%

Published: 5 Apr 2026
Updated: 6 Apr 2026
Reserved: 5 Apr 2026
Assigned by: VulnCheck

Description

CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks.

Scores

CVSS scores of CVE-2019-25674, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Analyzed	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.42% · top 63% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

VictorAlagwu · CMSsite
- affected 1.0

References (3)

ExploitDB-46402 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
VulnCheck Advisory: CMSsite 1.0 SQL Injection via post Parameter (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25674](https://trackcve.app/badge/CVE-2019-25674.svg)](https://trackcve.app/cve/CVE-2019-25674)

Record last updated 6 Apr 2026, 18:27 UTC.