CVE-2019-25573

Green CMS 2.x SQL Injection via cat Parameter

CVSS 7.1 HIGHEPSS 0.3%CWE-89

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

21 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cat parameter. Attackers can send GET requests to index.php with m=admin, c=posts, a=index parameters and inject SQL code in the cat parameter to manipulate database queries and extract sensitive information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Greencms · Green CMS

References

https://codeload.github.com/GreenCMS/GreenCMS/zip/beta https://www.exploit-db.com/exploits/46244 https://www.vulncheck.com/advisories/green-cms-2-x-sql-injection-via-cat-parameter http://www.greencms.net/