Loading story…
Three high-severity CVEs document SQL injection flaws in Kados R10 GreenBee that can be exploited remotely without privileges or user interaction. The vulnerabilities affect the filter_user_mail parameter (CVE-2019-25704), the id_project parameter (CVE-2019-25702), and the mng_profile_id parameter (CVE-2019-25690), all classified as CWE-89. The issues allow attackers to inject SQL into backend queries, creating a path to read sensitive database contents and, in some cases, alter stored data.
The CVE records include CVSS v3.1 and, for some entries, v4.0 scoring that describes low-complexity network exploitation with no authentication required. Public references tied to the disclosures include Exploit-DB, SourceForge, the Kados website, and a VulnCheck advisory, indicating that technical details and supporting material are available for defenders assessing exposure in GreenBee deployments.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented an SQL injection vulnerability in Kados R10 GreenBee affecting boards_buttons/update_feature.php, where the feature_id parameter was concatenated into SQL statements without sanitization. The record said unauthenticated attackers could use a crafted GET request with a UNION-based payload to extract sensitive database information.
Another CVE entry was received for an SQL injection vulnerability in Kados R10 GreenBee affecting the filter_user_mail parameter. The record noted potential extraction of sensitive information or modification of data and included CWE-89 and CVSS scoring details.
A separate CVE record documented an SQL injection flaw in Kados R10 GreenBee through the id_project parameter. The entry indicated attackers could manipulate database queries remotely with low complexity and no required privileges or user interaction.
A CVE record for an SQL injection vulnerability in Kados R10 GreenBee was received by disclosure@vulncheck.com, describing exploitation via the mng_profile_id parameter. The issue was classified as CWE-89 and described as remotely exploitable without privileges or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
Two newly disclosed SQL injection vulnerabilities affect **WWBN AVideo Live Schedule Reminder** and the **OpenSTAManager Aggiornamenti** module, exposing organizations to severe database compromise. `CVE-2026-33651` is a blind SQL injection issue in AVideo rated **CVSS 8.1** that can let attackers exfiltrate the full database, including email addresses, personal information, and password hashes, while also modifying or deleting records through injected `UPDATE` or `DELETE` statements. Repeated time-based exploitation attempts could also degrade service performance by exhausting server connection pools. `CVE-2026-35168` affects OpenSTAManager and allows an authenticated attacker to execute arbitrary SQL with the privileges of the configured database user, undermining confidentiality, integrity, and availability. In MySQL or MariaDB deployments with broad database permissions, the flaw can enable schema changes, stored procedure tampering, and theft of sensitive financial data; where the database account has the `FILE` privilege, attackers can escalate from database access to **remote code execution** on the application server by writing arbitrary files to the host filesystem.
Jun 29, 2026
NSA's **Ghidra** received multiple high-severity vulnerability disclosures affecting versions before **12.1** and, for one issue, before **12.0.2**. The most critical findings include **unauthenticated remote code execution** in the Shared Project feature (`CVE-2026-52751`), where a malicious project file with a `ghidra://` URL can trigger unsafe RMI deserialization before authentication when opened through **File → Open Project**. Advisories said the client uses `ObjectInputStream.readObject()` without a client-side `ObjectInputFilter`, and a working gadget chain exists using the bundled **Jython 2.7.4** library. A separate Windows-specific flaw (`CVE-2026-52750`) allows **command injection** when a user clicks a malicious URL embedded in program comments because `cmd.exe` metacharacters are not properly escaped. Additional disclosures affect other Ghidra components. `CVE-2026-52758` is a **SQL injection** flaw in **BSim** search filters that lets a low-privileged remote attacker inject arbitrary SQL into PostgreSQL-backed queries and potentially read, modify, or delete database contents. `CVE-2026-52752` is a **path traversal** bug in the extension installer that mishandles ZIP entry names such as `../`, allowing files to be written outside the intended directory and potentially leading to code execution. The RMI deserialization issue reportedly affects standard Ghidra releases with Shared Project support since **9.1** across **Linux, macOS, and Windows**, and the disclosures point to fixes and mitigations in Ghidra **12.1** and related security advisories.
Jun 29, 2026