What is the CVSS score of CVE-2019-25366?

CVE-2019-25366 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2019-25366?

Yes, a public proof-of-concept exploit is available for CVE-2019-25366. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25366?

Within 24 hours: Identify all systems running microASP Portal+ CMS and take inventory of exposed data (customer records, credentials, configurations). Within 7 days: Implement WAF rules blocking malicious payloads to the 'explode_tree' parameter, segment CMS infrastructure from critical systems, and disable the vulnerable feature if operationally feasible. Within 30 days: Contact vendor for patch availability or timeline; if unavailable, conduct full security assessment and plan migration to a patched alternative CMS platform.

CVE-2019-25366

HIGH

SQL Injection (CWE-89)

2026-02-22 disclosure@vulncheck.com

SQLi

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 23, 2026 - 18:13 vuln.today

Public exploit code

CVE Published

Feb 22, 2026 - 14:15 nvd

HIGH 8.2

DescriptionCVE.org

microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.

Affected ProductsAI

microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malic

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2019-25366 vulnerability details – vuln.today

Back

CVE-2019-25366

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code