TI-2018-15419 CVE-2018-25194 · GHSA-x32w-4fvg-cgrjNominas 0.27 SQL Injection via username ParameterPriority HIGH 77Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username parameter.CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00354 · Published 2026-03-06 · No fix listed CWE-22