CVE-2019-25641

HighPublic PoC

Published: 24 March 2026

Published

24 March 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0027 18.1th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25641 is a high-severity SQL Injection (CWE-89) vulnerability in Netartmedia Vlog System (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25641 is an SQL injection vulnerability (CWE-89) in the Netartmedia Vlog System. The flaw resides in the forgotten_password module of index.php, where the email parameter fails to properly sanitize user input, allowing attackers to inject arbitrary SQL code into database queries.

Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). By sending crafted POST requests to index.php with malicious values in the email parameter, attackers can manipulate database queries to extract sensitive information, achieving high confidentiality impact and low integrity impact without affecting availability.

References include an Exploit-DB entry (https://www.exploit-db.com/exploits/46583) detailing a proof-of-concept, the vendor site (https://www.netartmedia.net/vlogsystem/), and a Vulncheck advisory (https://www.vulncheck.com/advisories/netartmedia-vlog-system-lastest-sql-injection-via-email-parameter), which security practitioners should consult for any available patches or mitigation guidance. The CVE was published on 2026-03-24.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-20022

Vulnerability details

Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with malicious email values in the forgotten_password module to…

extract sensitive database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection vulnerability in unauthenticated public-facing web application directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary database queries for data collection (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0