CVE-2019-25366: Microasp Portal+ CMS

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.

Affected products

• Microasp Microasp Portal+ CMS: any version

Published 2026-02-22. Last modified 2026-06-17.