CVE-2019-15301

9.8 criticalEPSS 1.5%

Critical (9.8) in terrasoft bpm online crm system sdk. EPSS 1.5% chance of exploitation in the next 30 days.

A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2019-09-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

terrasoft:bpm_online_crm_system_sdk

References

https://medium.com/%40sorokinpf/bpmonline-sql-injection-607916447e30
https://medium.com/%40sorokinpf/bpmonline-sql-injection-607916447e30

Check your stack JSON