CVE-2019-25516

Jettweb PHP Hazir Haber Sitesi Scripti V1 SQL Injection via gallery.php

CVSS 8.8 HIGHEPSS 0.4%CWE-89

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

12 mar 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the gallery_id parameter. Attackers can send GET requests to gallery.php with malicious gallery_id values using UNION-based SQL injection to extract sensitive database information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

Jettweb · Hazir Haber Sitesi Scripti

Referencias

https://www.exploit-db.com/exploits/46597 https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v1-sql-injection-via-gallery-php