CVE WatchJul 24, 2026

CVE-2019-25674

CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL co

CVSS

8.2

High

EPSS

0.4%

p35

KEV

—

Exploit Today

0-100

Published: Apr 5, 2026 · Last modified: Jul 24, 2026 · CWE-89

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-08-252026-09-23

Technical description

CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-956019.3 CRI

—

——0Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.2h CVE-2026-955937.6 HIG

—

——0Editor SQL Injection in Ultimeter <= 3.0.8 versions.2h CVE-2026-955907.1 HIG

—

——0Subscriber SQL Injection in Tainacan <= 1.2.0 versions.2h CVE-2026-955227.6 HIG

—

——0Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.2h CVE-2026-941747.6 HIG

—

——0Administrator SQL Injection in Email Log <= 2.63 versions.2h CVE-2026-941248.5 HIG

—

——0Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.2h