{"id":"CVE-2018-25187","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-25187","generatedAt":"2026-10-28T20:12:54.186Z","title":"Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks.","description":"Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. Attackers can directly request the kim.db database file to retrieve user credentials and password hashes, or inject SQL code through the menu endpoint to manipulate database queries.","published":"2026-03-06T13:16:01.000Z","lastModified":"2026-06-17T01:54:54.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.8,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-89"],"affected":["tina4/tina4 stack"],"epss":{"score":0.00361,"percentile":0.29664,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.exploit-db.com/exploits/45833","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tina-stack-sql-injection-and-database-file-download","tags":["Broken Link"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-25187","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}