CVE-2019-25699CWE-89

Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter

High · published April 12, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

Newsbull Haber Script 1.0.0 contains multiple SQL injection vulnerabilities in the search parameter that allow authenticated attackers to extract database information through time-based, blind, and boolean-based injection techniques. Attackers can inject malicious SQL code through the search parameter in endpoints like /admin/comment/records, /admin/category/records, /admin/news/records, and /admin/menu/childs to manipulate database queries and retrieve sensitive data.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-12T12:28Z
EPSS history
Timeline
  • 12 APR 12:28Z
    Newsbull Haber Script 1.0.0 Authenticated SQL Injection via search parameter
    cvelistv5