High severity · published Feb 22, 2026
CVE-2019-25457
Web Ofisi Firma v13 SQL Injection via oz Parameter
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'oz' array parameter. Attackers can send GET requests to category pages with malicious 'oz[]' values using time-based blind SQL injection payloads to extract sensitive database information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firma · Web-ofisi
v13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25457
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25457
Exploit
https://www.exploit-db.com/exploits/47145
Broken Link
https://www.vulncheck.com/advisories/web-ofisi-firma-sql-injection-via-oz-parameter
Product
https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html