CVE-2019-25459

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

W

eb Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks.

References

Link	Resource
https://www.exploit-db.com/exploits/47142	Exploit
https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml	Broken Link
https://www.web-ofisi.com/detay/emlak-scripti-v3.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:web-ofisi:emlak:2.0.0:*:*:*:*:*:*:*

History

02 Mar 2026, 15:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.2~~	v2 : unknown v3 : 9.8

26 Feb 2026, 20:14

Type	Values Removed	Values Added
First Time		Web-ofisi Web-ofisi emlak
References	~~() https://www.exploit-db.com/exploits/47142 -~~	() https://www.exploit-db.com/exploits/47142 - Exploit
References	~~() https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml -~~	() https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml - Broken Link
References	~~() https://www.web-ofisi.com/detay/emlak-scripti-v3.html -~~	() https://www.web-ofisi.com/detay/emlak-scripti-v3.html - Product
CPE		cpe:2.3:a:web-ofisi:emlak:2.0.0:::::::*

23 Feb 2026, 18:13

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-22 15:16

Updated : 2026-03-02 15:16

NVD link : CVE-2019-25459

Mitre link : CVE-2019-25459

CVE.ORG link : CVE-2019-25459

JSON object : View

Products Affected

emlak

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2019-25459", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-22T15:16:15.757", "references": [{"url": "https://www.exploit-db.com/exploits/47142", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/web-ofisi-emlak-sql-injection-via-emlak-arahtml", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://www.web-ofisi.com/detay/emlak-scripti-v3.html", "tags": ["Product"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through GET parameters. Attackers can inject SQL code into parameters like emlak_durumu, emlak_tipi, il, ilce, kelime, and semt to extract sensitive database information or perform time-based blind SQL injection attacks."}, {"lang": "es", "value": "Web Ofisi Emlak V2 contiene m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en el endpoint que permiten a atacantes no autenticados manipular consultas a la base de datos a trav\u00e9s de par\u00e1metros GET. Los atacantes pueden inyectar c\u00f3digo SQL en par\u00e1metros como emlak_durumu, emlak_tipi, il, ilce, kelime y semt para extraer informaci\u00f3n sensible de la base de datos o realizar ataques de inyecci\u00f3n SQL ciega basada en tiempo."}], "lastModified": "2026-03-02T15:16:25.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:web-ofisi:emlak:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C9A9992-1A28-4A59-9D1A-E674DB874CA1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}