PT-2026-30492 · Opendocman · Opendocman

Mehmet Emiroglu · Publicado 2026-04-05 · Atualizado 2026-04-05 · CVE-2019-25684

Mitre

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'where' parameter. Attackers can send GET requests to search.php with malicious SQL payloads in the 'where' parameter to extract sensitive database information.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25684

Produtos afetados

Opendocman

Referências · 4

• 🔥 https://exploit-db.com/exploits/46500 · Exploit
• https://sourceforge.net/projects/opendocman/files · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25684 · Nota de Segurança
• https://vulncheck.com/advisories/opendocman-sql-injection-via-where-parameter · Nota