CVE-2019-25580

HighCVSS 8.2/10Last modified Oct 7, 2026

Description

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-255817.5i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting CVE-2019-255826.5i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipu CVE-2019-255835.5RarmaRadio 2.72.3 contains a denial of service vulnerability in the Username field that allows local attackers to crash the application by s CVE-2019-255845.5RarmaRadio 2.72.3 contains a buffer overflow vulnerability in the Server field of the Network settings that allows local attackers to crash CVE-2019-255855.5Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively lo CVE-2019-255865.5Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively lo CVE-2019-255875.5BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the Storage-Path configuration parameter that allows local CVE-2019-255885.5BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash CVE-2019-255895.5ZOC Terminal 7.23.4 contains a buffer overflow vulnerability in the Shell field of Program Settings that allows local attackers to crash the CVE-2019-255906.2Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by s CVE-2019-255916.2DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field that allows local attac CVE-2019-255926.2PHPRunner 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively l