CVE-2019-25433Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the gerar_pdf.php endpoint with malicious cid values to extract sensitive database information.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-22); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CRAC Learning - Tech@cracbot223d
Disclosure
CVE-2019-25433 (CVSS:8.8, HIGH) is Awaiting Analysis. XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database que..https://nvd.nist.gov/vuln/detail/CVE-2019-25433 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post discloses a high‑severity SQL injection vulnerability (CVE‑2019‑25433) in XOOPS CMS 2.5.9 and indicates it is awaiting analysis, but it does not mention any PoC, exploit, or patch.
0000011
173 followersView on X
CVETodo@CveTodo228d
Disclosure
**CVE-2019-25433** is a SQL injection vulnerability present in **XOOPS CMS version 2.5.9**. The flaw resides in the handling of the `cid` parameter within the `gerar_pdf.php` endpoint. An attacker can exploit this vulnerability by sending specially crafted GET requests with malicious SQL code embedded in the `cid` parameter, leading to unauthorized manipulation of database queries. #Cybersecurity #CVE #HighSeverity #SecurityAlert #SQLInjection #PrivilegeEscalation https://cvetodo.com/cve/CVE-2019-25433
Post summary
The post discloses a SQL injection vulnerability in XOOPS CMS 2.5.9 that allows attackers to inject SQL via the cid parameter in gerar_pdf.php, but it does not provide a PoC, exploit, or patch.
0000033
20 followersView on X

Explore more

Back to dashboard