CVE-2019-25458
CRITICALWeb Ofisi Firma Rehberi v1 - SQL Injection
Title source: llmDescription
Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can send requests to with malicious payloads in the 'il', 'kat', or 'kelime' parameters to extract sensitive database information or perform time-based blind SQL injection attacks.
Exploits (1)
exploitdb
WORKING POC
by Ahmet Ümit BAYRAM · textwebappslinux
https://www.exploit-db.com/exploits/47143
Scores
CVSS v3
9.8
EPSS
0.0013
EPSS Percentile
32.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-89
Status
published
Affected Products (1)
web-ofisi/firma_rehberi
Timeline
Published
Feb 22, 2026
Tracked Since
Feb 22, 2026