PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25698 Kados CVE debrief

CVE-2019-25698 Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete parameter. Attackers can send crafted requests with malicious SQL statements in the id_to_delete field to extract or modify sensitive database information. This vulnerability has a high CVSS score of 8.8 and is categorized as HIGH severity. Security teams and administrators should prioritize patching this vulnerability to prevent potential data breaches.

Vendor
Kados
Product
Kados R10 GreenBee
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-05
Original CVE updated
2026-07-24
Advisory published
2026-04-05
Advisory updated
2026-07-24

Who should care

Security teams and administrators responsible for Kados R10 GreenBee installations should prioritize patching this vulnerability to prevent potential data breaches. Additionally, operators and platform administrators should be aware of the vulnerability's impact and take necessary precautions to protect their systems.

Technical summary

The Kados R10 GreenBee application is vulnerable to SQL injection attacks through the id_to_delete parameter. This parameter allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability is rated as HIGH with a CVSS score of 8.8. To mitigate this vulnerability, input validation and sanitization should be implemented for the id_to_delete parameter.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on database security.

Recommended defensive actions

  • Apply patches or updates provided by the vendor to fix the SQL injection vulnerability.
  • Implement input validation and sanitization for the id_to_delete parameter to prevent malicious SQL injection.
  • Conduct regular security audits and vulnerability assessments to identify similar issues.
  • Monitor database activity for suspicious queries that may indicate attempted exploitation.
  • Consider implementing a web application firewall (WAF) to detect and block SQL injection attempts.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-05T21:16:48.480Z and was last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. The vulnerability is categorized under CWE-89. The source item URL for CVE-2019-25698 is provided, but additional verification is recommended due to limited source detail.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-25698 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-25698

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-25698 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25698

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.