What is CVE-2019-25506?

CVE-2019-25506 is a high-severity vulnerability in Freesms, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-03-04.

How severe is CVE-2019-25506?

High severity. CVSS v3 base score is 8.2 out of 10.

SQL Injection in Freesms

CVE-2019-25506

FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authentication by injecting SQL code through the login endpoint. Attackers can exploit the vulnerable password parameter in requests to /pages/crc_handler.php?method=login to authenticate as any known user and subsequently modify their password via the profile update function.

Vulnerability class: SQL Injection

EPSS: 0.005 (37.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Freesms — versions 2.1.2
Freesms_project Freesms

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com (Exploit, VDB Entry, exploit)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2019-25506?: CVE-2019-25506 is a high-severity vulnerability in Freesms, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-03-04.
How severe is CVE-2019-25506?: High severity. CVSS v3 base score is 8.2 out of 10.