CVE-2019-25726

HIGH

All in One Video Downloader 1.2 SQL Injection via admin page-edit

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-25726 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.

Description

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version details.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

All in One Video Downloader

Browse Nicheoffice / All in One Video Downloader
CVE List1.2affected

Proofs of concept

1

Catalogued exploits

ExploitDBAll in One Video Downloader 1.2 - (Authenticated) SQL InjectionExploitDB exploitby Deyaa MuhammadNot analyzed1 file
ExploitDB
PoC details

References

6