CVE-2019-25366: microASP Portal+ CMS SQL Injection via pagina.phtml

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-22 · updated 2026-06-17
Weakness: CWE-89

Description

microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.

Affected products

microASP (Portal+) CMS: all versions

References

http://www.microasp.it/
https://www.exploit-db.com/exploits/46799
https://www.vulncheck.com/advisories/microasp-portal-cms-sql-injection-via-paginaphtml

Get alerted when CVE-2019-25366 or the next vulnerability affects your stack