What is the CVSS score of CVE-2019-25455?

CVE-2019-25455 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of E Ticaret are affected by CVE-2019-25455?

Web Ofisi E-Ticaret v3 contains a critical SQL injection vulnerability that allows unauthenticated attackers to extract sensitive database information without any authentication.

Is there a public PoC exploit available for CVE-2019-25455?

Yes, a public proof-of-concept exploit is available for CVE-2019-25455. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25455?

Within 24 hours: Identify all systems running Web Ofisi E-Ticaret v3 and isolate them from production if possible, or restrict network access to trusted IPs only. Within 7 days: Deploy Web Application Firewall (WAF) rules to block requests containing SQL injection patterns in the 'a' parameter, and conduct a database audit to detect any unauthorized access or data extraction. Within 30 days: Contact the vendor for patch availability, evaluate migration to a patched alternative product, or decommission the affected application if no patch timeline is provided.

E Ticaret CVE-2019-25455

HIGH

SQL Injection (CWE-89)

2026-02-22 disclosure@vulncheck.com

SQLi E Ticaret

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Mar 02, 2026 - 15:16 vuln.today

Public exploit code

CVE Published

Feb 22, 2026 - 15:16 nvd

HIGH 7.5

DescriptionCVE.org

Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects E-Ticaret. Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'a' parameter. Attackers can send GET requests to with malicious 'a' parameter values to extract sensitive database information.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2019-25455 vulnerability details – vuln.today

Back

E Ticaret CVE-2019-25455

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code