CVE-2019-25457

HIGH 7.5CVE-2019-25457 · Published 22/02/2026 · updated 17/06/2026

In short

CVE-2019-25457 is a HIGH (CVSS 7.5) vulnerability affecting firma (web-ofisi).
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 40.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
firma web-ofisi	`= 13.0.0`	No fix yet

Description

Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'oz' array parameter. Attackers can send GET requests to category pages with malicious 'oz[]' values using time-based blind SQL injection payloads to extract sensitive database information.

References

exploit-db.com/exploits/47145 · Exploit
vulncheck.com/advisories/web-ofisi-firma-sql-injection-via-oz-parameter · Broken Link
web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free