# CVE-2019-25690: Kados R10 GreenBee SQL injection in multiple parameters

Source: https://junglewise.ai/threats/cve-2019-25690-kados-r10-greenbee-sql-injection-in-multiple-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25690 · Severity: high · CVSS 8.2 · Published 2026-04-05

Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, is vulnerable to SQL injection. This flaw allows an attacker to manipulate database queries by sending specially crafted web requests. Successful exploitation could lead to the unauthorized extraction of sensitive business data, including project details and user information, potentially compromising the confidentiality of corporate operations.

Technologies: [Kados R10 GreenBee](https://junglewise.ai/threats/technologies/kados-r10-greenbee). Vendors: [Kados](https://junglewise.ai/threats/vendors/kados).

## Quick answers

**Is CVE-2019-25690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25690 being exploited in the wild.

**How severe is CVE-2019-25690?** High severity, with a CVSS score of 8.2, published 5 April 2026.

**Which products and versions are affected?** Kados R10 GreenBee R10 GreenBee.

**Is there a fix for CVE-2019-25690?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25690 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-25690?** Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Kados R10 GreenBee is vulnerable to multiple SQL injection flaws, most notably in the 'mng_profile_id' parameter within the administration/profiles.php component. The vulnerability is caused by improper neutralization of special elements used in SQL commands (CWE-89). An unauthenticated remote attacker can exploit this by sending crafted GET requests containing malicious SQL payloads. Beyond 'mng_profile_id', other parameters such as 'menu_lev1', 'id_to_modify', and 'user2reset' are also reported as vulnerable, enabling both error-based and blind SQL injection. This allows for the extraction of sensitive data from the underlying MySQL database. While a newer version (R11-YellowCat) was released in late 2019, users should verify if these specific flaws are addressed or migrate to the latest version.

## Affected products

- Kados Kados R10 GreenBee R10 GreenBee

## Timeline

- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: other: Release of R11-YellowCat version
- 2026-04-05: advisory: CVE-2019-25690 published to NVD

## References

- [https://sourceforge.net/projects/kados/](https://sourceforge.net/projects/kados/)
- [https://www.exploit-db.com/exploits/46505](https://www.exploit-db.com/exploits/46505)
- [https://www.kados.info/](https://www.kados.info/)
- [https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-mng-profile-id](https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-mng-profile-id)

## Related threats

- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25704-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25702-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25700-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25698-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in language_tag parameter](https://junglewise.ai/threats/cve-2019-25696-kados-r10-greenbee-sql-injection-in-language-tag-parameter)