CVE-2019-25443

HIGH

Inventory Webapp SQL Injection via add-item.php

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25443 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.

Description

Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute arbitrary database commands.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 25, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

inventory-webapp

Browse edlangley / inventory-webapp
CVE List*affected

Proofs of concept

1

Catalogued exploits

ExploitDBInventory Webapp - 'itemquery' SQL injectionExploitDB exploitby mohammad zaheriNot analyzed1 file
ExploitDB
PoC details

References

3