CVE-2019-25506

🗓️ 04 Mar 2026 17:15:52Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 3 Views🌐 WEB

Boolean-based blind SQL injection in FreeSMS 2.1.2 enables unauthenticated login bypass and password update.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2019-25506	4 Mar 202617:15	–	attackerkb
Circl	CVE-2019-25506	4 Mar 202617:55	–	circl
CNNVD	FreeSMS SQL注入漏洞	4 Mar 202600:00	–	cnnvd
Cvelist	CVE-2019-25506 FreeSMS 2.1.2 Authentication Bypass via SQL Injection	4 Mar 202617:15	–	cvelist
EUVD	EUVD-2019-19732	4 Mar 202618:31	–	euvd
NVD	CVE-2019-25506	4 Mar 202618:16	–	nvd
Positive Technologies	PT-2026-22961	4 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2019-25506	5 Mar 202619:30	–	redhatcve
Vulnrichment	CVE-2019-25506 FreeSMS 2.1.2 Authentication Bypass via SQL Injection	4 Mar 202617:15	–	vulnrichment

NVD

Vulners

Node

freesms_project freesmsRange≤2.1.2

[
  {
    "vendor": "Freesms",
    "product": "FreeSMS",
    "versions": [
      {
        "version": "2.1.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/46658
vulncheck	www.vulncheck.com/advisories/freesms-authentication-bypass-via-sql-injection

Parameter	Position	Path	Description	CWE
password	query param	/pages/crc_handler.php?method=login	Boolean-based blind SQL injection in the login password parameter allowing unauthenticated bypass of authentication	CWE-89

07 Apr 2026 14:04Current

6Medium risk

Vulners AI Score6

CVSS 3.18.2 - 9.8

CVSS 48.8

EPSS0.00351

SSVC

CWE-89