CVE-2019-25582

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve configuration files and sensitive system data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-255835.5RarmaRadio 2.72.3 contains a denial of service vulnerability in the Username field that allows local attackers to crash the application by sCVE-2019-255845.5RarmaRadio 2.72.3 contains a buffer overflow vulnerability in the Server field of the Network settings that allows local attackers to crash CVE-2019-255855.5Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively loCVE-2019-255865.5Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively loCVE-2019-255875.5BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the Storage-Path configuration parameter that allows local CVE-2019-255885.5BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash CVE-2019-255895.5ZOC Terminal 7.23.4 contains a buffer overflow vulnerability in the Shell field of Program Settings that allows local attackers to crash theCVE-2019-255906.2Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by sCVE-2019-255916.2DNSS Domain Name Search Software 2.1.8 contains a buffer overflow vulnerability in the registration code input field that allows local attacCVE-2019-255926.2PHPRunner 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively lCVE-2019-255935.5jetCast Server 2.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessiveCVE-2019-255946.2ASPRunner.NET 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessive