CVE-2018-25194 - Nominas 0.27 SQL Injection via username Parameter · CoreCVE

Back Back to CVE browser

HIGH

Nominas 0.27 SQL Injection via username Parameter

Published Mar 6, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.32%

Description

Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username parameter. Attackers can send POST requests to the login/checklogin.php endpoint with crafted UNION-based SQL injection payloads to extract database information including usernames, database names, and version details.

Affected products

Vendor Arixolab Product Nominas Default
n/a
- Version
  0.27
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0.27	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://www.exploit-db.com/exploits/45820
exploit
https://www.vulncheck.com/advisories/nominas-sql-injection-via-username-parameter
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/45820		exploit
https://www.vulncheck.com/advisories/nominas-sql-injection-via-username-parameter		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulnCheck

Published Mar 6, 2026

Updated Mar 9, 2026

Reserved Mar 6, 2026

Link CVE-2018-25194

CISA Vulnrichment

Updated Mar 9, 2026

Status Deferred

Modified Jun 17, 2026

Link CVE-2018-25194

Severity n/a

Public date n/a

Links CVE-2018-25194

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a