Is CVE-2019-25696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25696 being exploited in the wild.

How severe is CVE-2019-25696?

High severity, with a CVSS score of 8.2, published 5 April 2026.

Which products and versions are affected?

Kados R10 GreenBee R10 GreenBee.

Is there a fix for CVE-2019-25696?

A patch was published on 2019-12-22: Version R11-YellowCat released which may address technical issues Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-25696 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2019-25696?

Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25696: Kados R10 GreenBee SQL injection in language_tag parameter

CVE-2019-25696 · Severity: high · CVSS 8.2 · Published 2026-04-05

Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, contains a security vulnerability that allows attackers to interfere with its database. By sending specially crafted requests, an unauthorized user could view sensitive information or modify data within the system. This could lead to the exposure of confidential project details or the unauthorized alteration of project records.

Technologies: Kados R10 GreenBee. Vendors: Kados.

Quick answers

Is CVE-2019-25696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25696 being exploited in the wild.
How severe is CVE-2019-25696?: High severity, with a CVSS score of 8.2, published 5 April 2026.
Which products and versions are affected?: Kados R10 GreenBee R10 GreenBee.
Is there a fix for CVE-2019-25696?: A patch was published on 2019-12-22: Version R11-YellowCat released which may address technical issues Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-25696 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2019-25696?: Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in Kados R10 GreenBee due to improper neutralization of special elements in the 'language_tag' parameter (and others including 'menu_lev1', 'mng_profile_id', 'id_to_modify', and 'user2reset'). An unauthenticated remote attacker can exploit this by sending crafted GET requests to various PHP endpoints such as languages.php or users.php. Successful exploitation allows for unauthorized data extraction via error-based or blind SQL injection techniques, and potentially data modification. While the advisory specifically highlights 'language_tag', public exploit code demonstrates the vulnerability across multiple parameters in the R10 GreenBee version.

Affected products

Kados Kados R10 GreenBee R10 GreenBee

Timeline

2019-03-07: disclosed: Exploit code published on Exploit-DB
2019-12-22: patched: Version R11-YellowCat released which may address technical issues
2026-04-05: advisory: CVE-2019-25696 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.