CVE-2019-25298CWE-89

html5_snmp 1.11 - 'Router_ID' SQL Injection

High · published February 6, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

⚡ A crafty attacker could exploit SQL injection vulnerabilities in html5_snmp 1.11 using just the Router_ID and Router_IP parameters! Think of it like a diner where the waiter takes orders but doesn't even check what goes into the kitchen—an attacker can slip in their own quirky requests for any dish they want, potentially mixing up your entire menu! 🍽️ This could lead to absolutely devastating consequences, like allowing attackers to extract confidential database information or even modify critical data. If they send crafted payloads, they could wreak havoc on your database, tampering with vital records and putting sensitive information at risk!

Put simply

Think of it like a diner where the waiter takes orders but doesn't even check what goes into the kitchen—an attacker can slip in their own quirky requests for any dish they want, potentially mixing up your entire menu! 🍽️ html5_snmp 1.11 harbors multiple SQL injection flaws that let attackers manipulate database queries through specific parameters, leveraging techniques like error-based and union-based injections.

What to do

This could lead to absolutely devastating consequences, like allowing attackers to extract confidential database information or even modify critical data. If they send crafted payloads, they could wreak havoc on your database, tampering with vital records and putting sensitive information at risk! To safeguard your system, patch html5_snmp to version 1.12 immediately. Additionally, consider implementing prepared statements and input validation to prevent similar exploits in the future. You've got this! With a quick patch and some extra precautions, you’ll keep your database safe and sound. 🛡️

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-06T16:41Z
EPSS history
Timeline
  • 06 FEB 16:41Z
    html5_snmp 1.11 - 'Router_ID' SQL Injection
    cvelistv5