CVE-2019-25440 — WebIncorp ERP Every version SQL Injection via product_detail.php

Back Back to CVE browser

HIGH

WebIncorp ERP Every version SQL Injection via product_detail.php

Published Feb 22, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.24%

Description

WebIncorp ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the prod_id parameter. Attackers can send GET requests to product_detail.php with malicious prod_id values to extract sensitive database information.

Affected products

Vendor Webincorp Product WebIncorp ERP Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Webincorp

WebIncorp ERP

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Metrics

0.24% 0.00241

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00241

Score over time

Feb–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.24% (0.00241)	13.81th	v5 (v2026.06.15)
Jun 15, 2026	0.23% (0.00232)	13.84th	v5 (v2026.06.15)
Feb 23, 2026	0.07% (0.00066)	20.54th	v4 (v2025.03.14)

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://www.exploit-db.com/exploits/47199
exploit
https://www.vulncheck.com/advisories/webincorp-erp-every-version-sql-injection-via-productdetailphp
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/47199		exploit
https://www.vulncheck.com/advisories/webincorp-erp-every-version-sql-injection-via-productdetailphp		third-party-advisory