CVE-2019-25521

HighPublic PoC

Published: 12 March 2026

Published

12 March 2026

Modified

23 March 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0009 25.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25521 is a high-severity SQL Injection (CWE-89) vulnerability in Xooscripts Xoogallery. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Information Input Validation directly prevents SQL injection by requiring validation and sanitization of the gal_id parameter in gal.php.

SI-2 Flaw Remediation good match

prevent

Flaw Remediation addresses the vulnerability by identifying, prioritizing, and applying patches or fixes for CVE-2019-25521 in XooGallery.

AU-13 Monitoring for Information Disclosure partial match

detect

Monitoring for Information Disclosure detects exploitation attempts that extract sensitive database information via SQL injection in the gal_id parameter.

NVD Description

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the gal_id parameter. Attackers can send GET requests to gal.php with malicious gal_id values to extract sensitive database information or…

modify database contents.

Deeper analysisAI

CVE-2019-25521 is an SQL injection vulnerability (CWE-89) in XooGallery Latest, affecting the gal.php component through the gal_id parameter. This flaw allows attackers to inject malicious SQL code into database queries via GET requests. The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending crafted GET requests to gal.php with malicious values in the gal_id parameter, they can manipulate database queries to extract sensitive information or modify database contents.

Advisories and related resources, including those from VulnCheck and an exploit listing on Exploit-DB (46609), detail the vulnerability but do not specify patches or mitigations in the provided information. Security practitioners should review these references for PoC details and apply input validation or upgrade to a patched version if available.