Which versions of PHP are affected by CVE-2019-25537?

Netartmedia Event Portal 2.0 contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract or manipulate database contents without valid credentials.

Is there a public PoC exploit available for CVE-2019-25537?

Yes, a public proof-of-concept exploit is available for CVE-2019-25537. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2019-25537?

Within 24 hours: Isolate affected Event Portal instances from production networks if feasible, or implement emergency WAF rules blocking SQL injection patterns on the Email parameter. Within 7 days: Conduct forensic analysis of database access logs to identify unauthorized queries and potential data exfiltration; notify affected customers if compromise is confirmed. Within 30 days: Migrate to alternative event management platform or evaluate third-party patched versions; implement input validation and parameterized queries if source code access permits; deploy comprehensive database activity monitoring.

PHP CVE-2019-25537

Q: What is the CVSS score of CVE-2019-25537?

CVE-2019-25537 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

SQL Injection (CWE-89)

2026-03-12 disclosure@vulncheck.com

PHP SQLi

8.8

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.2 (HIGH) 8.8 (HIGH)

PoC Detected

Mar 12, 2026 - 21:07 vuln.today

Public exploit code

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 16:16 nvd

HIGH 8.2

DescriptionNVD

Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email field to extract sensitive database information.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email field to extract sensitive database information.

Affected ProductsAI

Component: Email.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2019-25537 vulnerability details – vuln.today

Back

PHP CVE-2019-25537

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

PHP CVE-2019-25537

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code