Is CVE-2019-25698 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25698 being exploited in the wild.

How severe is CVE-2019-25698?

High severity, with a CVSS score of 8.2, published 5 April 2026.

Which products and versions are affected?

Kados R10 GreenBee R10 GreenBee.

Is there a fix for CVE-2019-25698?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25698 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2019-25698?

Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25698: Kados R10 GreenBee SQL injection in multiple parameters

CVE-2019-25698 · Severity: high · CVSS 8.2 · Published 2026-04-05

Kados R10 GreenBee, a web-based project management tool for Scrum and Agile teams, is vulnerable to SQL injection. This flaw allows an attacker to manipulate database queries, potentially leading to the unauthorized viewing or modification of sensitive project data, user information, and system configurations. Organizations using this tool for project tracking may face risks to data integrity and confidentiality.

Technologies: Kados R10 GreenBee. Vendors: Kados.

Quick answers

Is CVE-2019-25698 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25698 being exploited in the wild.
How severe is CVE-2019-25698?: High severity, with a CVSS score of 8.2, published 5 April 2026.
Which products and versions are affected?: Kados R10 GreenBee R10 GreenBee.
Is there a fix for CVE-2019-25698?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25698 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2019-25698?: Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Kados R10 GreenBee is vulnerable to multiple SQL injection flaws due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability exists in several parameters, most notably 'id_to_delete', 'menu_lev1', 'mng_profile_id', 'id_to_modify', and 'user2reset'. An unauthenticated remote attacker can send specially crafted GET requests containing malicious SQL statements to these parameters. Successful exploitation allows the attacker to extract sensitive data from the MySQL database, modify records, or perform blind SQL injection (e.g., using SLEEP commands). While a newer version (R11-YellowCat) was released in late 2019, users should verify if these specific vulnerabilities are addressed or migrate to the latest supported version.

Affected products

Kados Kados R10 GreenBee R10 GreenBee

Timeline

2019-03-07: disclosed: Exploit code published on Exploit-DB
2019-12-22: other: Newer version R11-YellowCat released
2026-04-05: advisory: CVE-2019-25698 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.