CVE-2019-25303CWE-89

TheJshen contentManagementSystem 1.04 - 'id' SQL Injection

High · published February 6, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

⚡ Just a single cleverly crafted URL is enough for attackers to take control! TheJshen ContentManagementSystem 1.04 is vulnerable to SQL injection through the 'id' GET parameter, and it's time to act! 🔥 Think of it like a restaurant where the waiter takes orders without checking with the kitchen first. If a customer can shout out whatever they want without any checks, they might end up getting dishes that were never meant for them—or worse, have the kitchen cook up something harmful! An attacker could manipulate database queries, extracting sensitive information or altering your data—talk about a recipe for disaster! Imagine someone accessing your customer records or even tampering with your content—absolutely devastating!

Put simply

Think of it like a restaurant where the waiter takes orders without checking with the kitchen first. If a customer can shout out whatever they want without any checks, they might end up getting dishes that were never meant for them—or worse, have the kitchen cook up something harmful! This vulnerability allows SQL injection by exploiting the 'id' parameter in GET requests, letting attackers use various techniques (like boolean-based, time-based, or UNION-based) to manipulate the database without proper authorization.

What to do

An attacker could manipulate database queries, extracting sensitive information or altering your data—talk about a recipe for disaster! Imagine someone accessing your customer records or even tampering with your content—absolutely devastating! To safeguard your system, patch to version 1.05 immediately! Also, consider sanitizing user inputs and using prepared statements to mitigate SQL injection risks in the future. You've got this! With these steps, you'll strengthen your defenses and keep your database safe! 🛡️

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-06T16:41Z
EPSS history
Timeline
  • 06 FEB 16:41Z
    TheJshen contentManagementSystem 1.04 - 'id' SQL Injection
    cvelistv5