CVE-2019-25325 HIGH

CVE-2019-25325: Thrive Smart Home 1.1 - 'Smart Home' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Vendor Thrive

Product Smart Home

Weakness CWE-89 · SQLi

Published February 12, 2026

Last update March 5, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the 'user' POST parameter. Attackers can inject malicious SQL code like ' or 1=1# to manipulate login queries and gain unauthorized access to the application.

Key dates

02Disclosure timeline

February 12, 2026 CVE published

March 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25325 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-62617 Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality CVE-2025-12262 code-projects Online Event Judging System edit_criteria.php sql injection CVE-2025-4264 PHPGurukul Emergency Ambulance Hiring Portal edit-ambulance.php sql injection CVE-2026-42741 WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability CVE-2026-32234 Parse Server has a SQL injection via query field name when using PostgreSQL