What is the CVSS score of CVE-2019-25505?

CVE-2019-25505 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Tradebox are affected by CVE-2019-25505?

Tradebox 5.4 contains a high-severity SQL injection vulnerability affecting authenticated users, enabling attackers with valid credentials to compromise database integrity and confidentiality.

Is there a public PoC exploit available for CVE-2019-25505?

Yes, a public proof-of-concept exploit is available for CVE-2019-25505. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2019-25505?

Within 24 hours: inventory all Tradebox 5.4 deployments and identify which systems handle sensitive data; restrict database access privileges where possible and enable detailed audit logging. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns in the symbol parameter; consider disabling the vulnerable feature if operationally feasible. Within 30 days: contact vendor for patch availability; if unavailable, plan upgrade to alternative software or isolated environment deployment with network segmentation.

Tradebox CVE-2019-25505

HIGH

SQL Injection (CWE-89)

2026-03-04 disclosure@vulncheck.com

SQLi Tradebox

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 09, 2026 - 17:57 vuln.today

Public exploit code

CVE Published

Mar 04, 2026 - 18:16 nvd

HIGH 7.1

DescriptionCVE.org

Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. Attackers can send POST requests to the monthly_deposit endpoint with malicious symbol values using boolean-based blind, time-based blind, error-based, or union-based SQL injection techniques to extract sensitive database information.

AnalysisAI

Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. [CVSS 7.1 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the symbol component of Tradebox. Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. Attackers can send POST requests to the monthly_deposit endpoint with malicious symbol values using boolean-based blind, time-based blind, error-based, or union-based SQL injection techniques to extract sensitive database information.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2019-25505 vulnerability details – vuln.today

Back