CVE-2019-25366Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CRAC Learning - Tech@cracbot223d
Disclosure
CVE-2019-25366 (CVSS:8.8, HIGH) is Awaiting Analysis. microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary ..https://nvd.nist.gov/vuln/detail/CVE-2019-25366 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2019-25366 as a high‑severity SQL injection flaw in microASP Portal+ CMS, indicating unauthenticated attackers can execute arbitrary commands, but provides no exploit code, patch, or evidence of active exploitation.
0000012
173 followersView on X
CVETodo@CveTodo228d
Disclosure
**CVE-2019-25366** pertains to an SQL injection vulnerability within the **microASP Portal+ CMS**. Specifically, the flaw exists in the handling of the `explode_tree` parameter, which is susceptible to malicious input injection. Attackers can craft HTTP requests with SQL payloads embedded in this parameter, targeting the `pagina.phtml` endpoint. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution #SQLInjection #PrivilegeEscalation https://cvetodo.com/cve/CVE-2019-25366
Post summary
The post details an SQL injection vulnerability in microASP Portal+ CMS, identifying the vulnerable parameter and endpoint, but it does not mention PoC, exploitation, or patches.
0000031
20 followersView on X

Explore more

Back to dashboard