CVE-2019-25580CWE-434unrestricted-file-upload

CVE-2019-25580

High · published March 21, 2026

CVSS v3.1

8.2

EPSS

Percentile

24.9

In the wild

Unconfirmed

What it is

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.

The record

Technical detail

CVSS v3.1: 8.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00330 · 24.9th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2026-03-21T20:16Z

Affected products (1)

Product	Versions	Fixed in
owndms/owndms	≤ 4.7	—

References (4)

http://www.owndms.com/ · [email protected]https://datapacket.dl.sourceforge.net/project/owndms/owndms_47.zip · [email protected]https://www.exploit-db.com/exploits/46168 · [email protected]https://www.vulncheck.com/advisories/owndms-sql-injection-via-pdfstream-php-imagestream-php · [email protected]

EPSS history

Timeline

21 MAR 15:30Z
ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php
cvelistv5