CVE-2019-25501 HIGH

CVE-2019-25501: Simple Job Script SQL Injection via delete_application_ajax.php

Vendor Niteosoft

Product Simple Job Script

Weakness CWE-89 · SQLi

Published March 4, 2026

Last update July 28, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_id parameter. Attackers can send POST requests to delete_application_ajax.php with crafted payloads to extract sensitive data, bypass authentication, or modify database contents.

Key dates

02Disclosure timeline

March 4, 2026 CVE published

July 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25501 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability CVE-2026-28184 WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability