Is CVE-2019-25359 actively exploited?

A weaponized exploit exists for CVE-2019-25359, making exploitation likely. It is not yet confirmed in the CISA KEV catalog.

Can CVE-2019-25359 be exploited remotely?

Yes. CVE-2019-25359 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-25359?

CVE-2019-25359 has a CVSS score of 8.2 (HIGH) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2019-25359

HIGHWEAPONIZED

CVE-2019-25359

CWE-352Published: February 18, 2026· Updated: Feb 19, 2026

8.2

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.3th

Official Description

SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL statements through POST parameters 'idtyp' and 'idgremium'. Attackers can exploit this vulnerability by crafting specially formed POST requests to the /vorlagen/ endpoint, enabling unauthorized database manipulation and potential information disclosure.

NVD Source

Technical Analysis

CVE-2019-25359 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 8.2.

A weaponized exploit for CVE-2019-25359 is publicly known. This significantly lowers the barrier for threat actors and increases the urgency for remediation.