CVE-2019-25697

CVE-2019-25697 is an unauthenticated SQL injection vulnerability affecting CMSsite version 1.0, exploitable through the cat_id parameter in category.php. Attackers can inject malicious SQL code via GET requests to manipulate database queries and extract sensitive information including usernames and credentials. The vulnerability carries a CRITICAL severity rating of 9.8 CVSS with a network-based attack vector requiring no authentication, low attack complexity, and no user interaction. The impact is severe, with high confidentiality, integrity, and availability consequences, allowing complete compromise of database confidentiality and integrity. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and does not appear to be actively exploited. The EPSS score of 0.00244 indicates relatively lower predictive probability of exploitation compared to other CVEs, and the vulnerability maintains an inactive status on threat tracking lists, suggesting limited community attention or active exploitation activity.