What is the CVSS score of CVE-2019-25498?

CVE-2019-25498 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Simplejobscript are affected by CVE-2019-25498?

An unauthenticated SQL injection vulnerability in Simple Job Script (CVE-2019-25498) allows attackers to manipulate database queries and potentially access, modify, or delete sensitive business data…

Is there a public PoC exploit available for CVE-2019-25498?

Yes, a public proof-of-concept exploit is available for CVE-2019-25498. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2019-25498?

Within 24 hours: Identify all systems running Simple Job Script and isolate them from production networks if possible; enable enhanced database logging and monitoring for suspicious queries. Within 7 days: Implement WAF rules to block SQL injection patterns in the landing_location parameter; apply input validation and parameterized queries at the application layer if source code access exists. Within 30 days: Evaluate migration to alternative job scheduling solutions with active security support; if staying with Simple Job Script, establish a dedicated security monitoring and incident response plan.

Simplejobscript CVE-2019-25498

HIGH

SQL Injection (CWE-89)

2026-03-04 disclosure@vulncheck.com

Authentication Bypass SQLi Simplejobscript

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 06, 2026 - 20:50 vuln.today

Public exploit code

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 8.2

DescriptionCVE.org

Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with malicious SQL payloads to bypass authentication and extract sensitive database information.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the landing_location component of Simplejobscript. Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with malicious SQL payloads to bypass authentication and extract sensitive database information.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.