CVE-2019-25459

Web Ofisi Emlak V2 SQL Injection via emlak-ara.html

CVSS 8.8 HIGHEPSS 0.4%CWE-89

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Web-ofisi · Emlak

Referências

https://www.exploit-db.com/exploits/47142 https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml https://www.web-ofisi.com/detay/emlak-scripti-v3.html