CVE-2019-25515

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25515
Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated attackers to gain administrative access by submitting crafted SQL syntax. Attackers can bypass authentication by submitting equals signs and 'or' operators as username and password parameters to access the administration panel without valid credentials.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/46599 Exploit VDB Entry
https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*:*
History

17 Mar 2026, 19:30

Type Values Removed Values Added
Summary
  • (es) Jettweb PHP Hazir Haber Sitesi Scripti V3 contiene una vulnerabilidad de omisión de autenticación en el panel de administración login.php que permite a atacantes no autenticados obtener acceso administrativo al enviar sintaxis SQL manipulada. Los atacantes pueden omitir la autenticación al enviar signos de igual y operadores 'or' como parámetros de nombre de usuario y contraseña para acceder al panel de administración sin credenciales válidas.
CPE cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*:*
First Time Jettweb php Stock News Site Script
Jettweb
References () https://www.exploit-db.com/exploits/46599 - () https://www.exploit-db.com/exploits/46599 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass - () https://www.vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass - Third Party Advisory

12 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-12 16:16

Updated : 2026-03-17 19:30

NVD link : CVE-2019-25515

Mitre link : CVE-2019-25515

CVE.ORG link : CVE-2019-25515

JSON object : View

Products Affected

jettweb

  • php_stock_news_site_script
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')