CVE-2019-25636

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25636
Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id' GET parameter. Attackers can send crafted requests to news_details.php, jobs_details.php, or job_cmp_details.php with malicious 'id' values using GROUP BY and CASE statements to extract sensitive database information.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.zeeways.com/jobsite-cms/1/productdetail Broken Link
https://www.exploit-db.com/exploits/46602 Exploit VDB Entry
https://www.vulncheck.com/advisories/zeeways-jobsite-cms-lastest-sql-injection-via-id-parameter Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zeeways:jobsite_cms:-:*:*:*:*:*:*:*
History

15 Apr 2026, 16:10

Type Values Removed Values Added
References () http://www.zeeways.com/jobsite-cms/1/productdetail - () http://www.zeeways.com/jobsite-cms/1/productdetail - Broken Link
References () https://www.exploit-db.com/exploits/46602 - () https://www.exploit-db.com/exploits/46602 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/zeeways-jobsite-cms-lastest-sql-injection-via-id-parameter - () https://www.vulncheck.com/advisories/zeeways-jobsite-cms-lastest-sql-injection-via-id-parameter - Third Party Advisory
CPE cpe:2.3:a:zeeways:jobsite_cms:-:*:*:*:*:*:*:*
First Time Zeeways jobsite Cms
Zeeways
Summary
  • (es) Zeeways Jobsite CMS contiene una vulnerabilidad de inyección SQL que permite a atacantes no autenticados manipular consultas de base de datos inyectando código SQL a través del parámetro GET 'id'. Los atacantes pueden enviar solicitudes manipuladas a news_details.php, jobs_details.php o job_cmp_details.php con valores 'id' maliciosos utilizando sentencias GROUP BY y CASE para extraer información sensible de la base de datos.

24 Mar 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-24 12:16

Updated : 2026-04-15 16:10

NVD link : CVE-2019-25636

Mitre link : CVE-2019-25636

CVE.ORG link : CVE-2019-25636

JSON object : View

Products Affected

zeeways

  • jobsite_cms
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')