CVE-2019-25676 Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection
Unauthenticated attackers can inject SQL or scripts via URL parameters to execute code or extract database information in Ask Expert Script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25676?
CVE-2019-25676 is a high-severity SQL injection vulnerability in Phpscriptsmall Ask Expert Script, published on 5 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view parameter in list-details.php to execute arbitrary code or extract database information.
Which versions are affected by CVE-2019-25676?
It affects 1 product.
Products include Phpscriptsmall Ask Expert Script.
How do I fix CVE-2019-25676?
No fix has been published for CVE-2019-25676 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-25676 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25676 exists.
Sources
Also known as GHSA-p86f-7g2v-f63j.