PT-2026-23697 · Unknown · Tina4 Stack

CVE-2018-25187 · Publicado 2026-03-06 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tina4 Stack version 1.0.3

Description Tina4 Stack version 1.0.3 has multiple issues that allow unauthenticated attackers to access sensitive database files and execute SQL injection attacks. Attackers can directly request the kim.db database file to retrieve user credentials and password hashes. SQL code can be injected through the /menu API endpoint to manipulate database queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-25187

Produtos afetados

Tina4 Stack

Referências · 5

• 🔥 https://exploit-db.com/exploits/45833 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25187 · Nota de Segurança
• https://t.me/CVEtracker/46602 · Publicação no Telegram
• https://vulncheck.com/advisories/tina-stack-sql-injection-and-database-file-download · Nota
• https://t.me/cveNotify/155549 · Publicação no Telegram