PT-2026-23697 · Unknown · Tina4 Stack

Published 2026-03-06 · Updated 2026-03-16 · CVE-2018-25187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tina4 Stack version 1.0.3

Description Tina4 Stack version 1.0.3 has multiple issues that allow unauthenticated attackers to access sensitive database files and execute SQL injection attacks. Attackers can directly request the kim.db database file to retrieve user credentials and password hashes. SQL code can be injected through the /menu API endpoint to manipulate database queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25187

Affected Products

Tina4 Stack

References · 5

• 🔥 https://exploit-db.com/exploits/45833 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25187 · Security Note
• https://t.me/CVEtracker/46602 · Telegram Post
• https://vulncheck.com/advisories/tina-stack-sql-injection-and-database-file-download · Note
• https://t.me/cveNotify/155549 · Telegram Post