Read the docs
TI-2019-15746 Aliases CVE-2019-25694GHSA-x43m-phhc-g74h

Kados R10 GreenBee SQL Injection via user2reset

Priority HIGH 77CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted requests with malicious SQL payloads to extract sensitive database information or modify data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KadosKados R10 GreenBeeR10 GreenBee—No fix listedCNA
  • Kados R10 GreenBee VendorKados Affected R10 GreenBee Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:marmotech:kados:r10_greenbee:*:*:*:*:*:*:*r10_greenbeeVulnerableKados
  • cpe:2.3:a:marmotech:kados:r10_greenbee:*:*:*:*:*:*:* Versions r10_greenbee Vulnerable ·Kados

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25694
  2. 2026-10-03 Alias added: GHSA-x43m-phhc-g74h

References

Exploit 1

Other 2

  • TI-2019-15756 Kados R10 GreenBee SQL Injection via filter_user_mail CVSS 4.0HIGH 8.8
  • TI-2019-15754 Kados R10 GreenBee SQL Injection via id_project Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15752 Kados R10 GreenBee SQL Injection via sort_direction Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15750 Kados R10 GreenBee SQL Injection via id_to_delete Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15748 Kados R10 GreenBee SQL Injection via language_tag Parameter CVSS 4.0HIGH 8.8
  • TI-2019-15744 Kados R10 GreenBee SQL Injection via id_to_modify Parameter CVSS 4.0HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences