QSearchQSearch

CVE-2019-25728

8.2 HIGH

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by mani...

Published: 2026-06-04 · Last updated: 2026-06-04

Severity and scoring

CVSS
8.2 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE
CWE-89

Description

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-48613 — SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migratio... (5.9 MEDIUM)
  • CVE-2026-45418 — ClipBucket v5 is an open source video sharing platform (8.8 HIGH)
  • CVE-2026-45060 — ClipBucket v5 is an open source video sharing platform (9.8 CRITICAL)
  • CVE-2026-42647 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL ... (9.3 CRITICAL)
  • CVE-2026-39494 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW a... (9.3 CRITICAL)