PT-2026-24975 · Jettweb · Hazir Haber Sitesi Scripti+1

Published 2026-03-12 · Updated 2026-03-12 · CVE-2019-25515

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jettweb PHP Hazir Haber Sitesi Scripti versions 3.0 through 3.0

Description The software contains an authentication bypass issue in the login.php administration panel. An unauthenticated attacker can gain administrative access by submitting crafted SQL syntax. Attackers can bypass authentication by submitting equals signs and 'or' operators as username and password parameters to access the administration panel without valid credentials. The API endpoint ''login.php'' is affected.

Recommendations Versions prior to 3.0 should be used.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25515

Affected Products

Hazir Haber Sitesi Scripti

Php Stock News Site Script

References · 3

• 🔥 https://exploit-db.com/exploits/46599 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25515 · Security Note
• https://vulncheck.com/advisories/jettweb-php-hazir-haber-sitesi-scripti-v3-authentication-bypass · Note