TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Kostasmitroglou
  • Password Management Application
  • Thesystem

Configuration 1 [-]

cpe:2.3:a:kostasmitroglou:password_management_application:1.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/kostasmitroglou/thesystem cve-icon cve-icon
https://www.exploit-db.com/exploits/47430 cve-icon cve-icon
https://www.vulncheck.com/advisories/thesystem-servername-sql-injection cve-icon cve-icon
History

Mon, 02 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Fri, 27 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Kostasmitroglou password Management Application
CPEs cpe:2.3:a:kostasmitroglou:password_management_application:1.0:*:*:*:*:*:*:*
Vendors & Products Kostasmitroglou password Management Application

Fri, 13 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Kostasmitroglou
Kostasmitroglou thesystem
Vendors & Products Kostasmitroglou
Kostasmitroglou thesystem

Thu, 12 Feb 2026 19:30:00 +0000

Type Values Removed Values Added
Description TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information.
Title thesystem 1.0 - 'server_name' SQL Injection
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-02-12T19:02:35.562Z

Updated: 2026-03-02T14:49:36.953Z

Reserved: 2026-02-12T18:30:57.692Z

Link: CVE-2019-25346

cve-icon Vulnrichment

Updated: 2026-02-12T19:48:02.849Z

cve-icon NVD

Status : Modified

Published: 2026-02-12T20:16:01.593

Modified: 2026-03-02T15:16:22.840

Link: CVE-2019-25346

cve-icon Redhat

No data.