Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0059 45.5 —
AFFECTED Product Versions Fixed ASP-CMS unspecified —
TIMELINE Aug 13 Reserved by VulnCheck Aug 13 Published (CNA: VulnCheck) Aug 14 EXPLOIT PUBLISHED — CVE-2019-25765 (ASP-CMS Project ASP-CMS). Public exploit reference added.
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
| Date | Event | Detail |
|---|---|---|
| August 13, 2026 | Reserved | Reserved by VulnCheck |
| August 13, 2026 | Published | Published (CNA: VulnCheck) |
| August 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2019-25765 (ASP-CMS Project ASP-CMS). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| ASP-CMS Project | ASP-CMS | — | — | — |
Authoritative record: CVE-2019-25765 at cve.org
Vendors: asp-cms project
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-25765 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.