CVE-2019-25696

HighPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

07 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0031 22.7th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25696 is a high-severity SQL Injection (CWE-89) vulnerability in Marmotech Kados. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25696 is an SQL injection vulnerability (CWE-89) in Kados R10 GreenBee, where the language_tag parameter fails to properly sanitize user input. This flaw enables attackers to inject and execute arbitrary SQL code directly into database queries, potentially compromising the underlying database.

The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating it is exploitable over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation allows attackers to extract sensitive database information, such as user credentials or other confidential data, and perform limited data modifications, though it does not impact availability.

Advisories and additional details are documented in resources including the VulnCheck advisory on the Kados R10 GreenBee SQL injection via language_tag parameter, the Kados project pages on SourceForge and kados.info, and an exploit on Exploit-DB (ID 46505). No specific patches or mitigation steps are detailed in the provided references.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-20117

Vulnerability details

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag parameter. Attackers can submit malicious SQL statements in the language_tag parameter to extract sensitive database information or modify…

data.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a network-accessible web application directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote attackers.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0