CVE-2019-25457

8.8 highEPSS 0.5%

High (8.8) in web-ofisi firma. EPSS 0.5% chance of exploitation in the next 30 days.

Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'oz' array parameter. Attackers can send GET requests to category pages with malicious 'oz[]' values using time-based blind SQL injection payloads to extract sensitive database information.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

web-ofisi:firma

References

https://www.exploit-db.com/exploits/47145
https://www.vulncheck.com/advisories/web-ofisi-firma-sql-injection-via-oz-parameter
https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html

Check your stack JSON