CVE-2019-25680

CVE-2019-25680 is an SQL injection vulnerability affecting Advance Gift Shop Pro Script version 2.0.3 that enables unauthenticated attackers to execute arbitrary SQL queries through the search parameter. Malicious actors can inject SQL payloads into the 's' parameter to extract sensitive database information, including version details and other confidential data. The vulnerability has a high severity rating of 8.2 CVSS, with a network-based attack vector requiring no authentication, low attack complexity, and no user interaction. The attack carries high confidentiality impact and limited integrity impact, though system availability is not compromised. There is no evidence of active exploitation in the wild, and this vulnerability does not appear on the KEV catalog or active hot list, suggesting limited community attention and potentially no publicly available exploit code. The EPSS score of 0.000860 indicates a relatively low probability of exploitation compared to other CVEs, though organizations running the affected software version should still address this vulnerability through patching or mitigation.