# CVE-2019-25704: Kados R10 GreenBee SQL injection in multiple parameters

Source: https://junglewise.ai/threats/cve-2019-25704-kados-r10-greenbee-sql-injection-in-multiple-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25704 · Severity: high · CVSS 8.2 · Published 2026-04-05

Kados R10 GreenBee, a web-based tool for managing Scrum and Agile projects, contains a security vulnerability that allows unauthorized individuals to interfere with its database. By sending specially crafted web requests, an attacker can view sensitive information or modify data within the system. This could lead to the exposure of project management data or unauthorized changes to project tasks and user profiles.

Technologies: [Kados R10 GreenBee](https://junglewise.ai/threats/technologies/kados-r10-greenbee). Vendors: [Kados](https://junglewise.ai/threats/vendors/kados).

## Quick answers

**Is CVE-2019-25704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25704 being exploited in the wild.

**How severe is CVE-2019-25704?** High severity, with a CVSS score of 8.2, published 5 April 2026.

**Which products and versions are affected?** Kados R10 GreenBee R10 GreenBee.

**Is there a fix for CVE-2019-25704?** A patch was published on 2019-12-22: New version R11-YellowCat released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-25704 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-25704?** Check whether you run Kados R10 GreenBee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in Kados R10 GreenBee due to improper neutralization of special elements in several parameters, most notably 'filter_user_mail', 'menu_lev1', 'mng_profile_id', and 'id_to_modify'. The flaw is reachable via unauthenticated or low-privileged GET requests to various PHP endpoints including projects.php and users.php. An attacker can exploit this to perform out-of-band data extraction, error-based SQL injection, or time-based blind SQL injection. This allows for the unauthorized retrieval of sensitive database contents or the modification of existing records. While the vulnerability was identified in 2019, it was formally assigned a CVE in 2026; users should upgrade to a supported version such as R11-YellowCat or later.

## Affected products

- Kados Kados R10 GreenBee R10 GreenBee

## Timeline

- 2019-03-07: disclosed: Exploit code published on Exploit-DB
- 2019-12-22: patched: New version R11-YellowCat released
- 2026-04-05: advisory: CVE-2019-25704 published

## References

- [https://sourceforge.net/projects/kados/](https://sourceforge.net/projects/kados/)
- [https://www.exploit-db.com/exploits/46505](https://www.exploit-db.com/exploits/46505)
- [https://www.kados.info/](https://www.kados.info/)
- [https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-filter-user-mail](https://www.vulncheck.com/advisories/kados-r10-greenbee-sql-injection-via-filter-user-mail)

## Related threats

- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25702-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25700-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in multiple parameters](https://junglewise.ai/threats/cve-2019-25698-kados-r10-greenbee-sql-injection-in-multiple-parameters)
- [Kados R10 GreenBee SQL injection in language_tag parameter](https://junglewise.ai/threats/cve-2019-25696-kados-r10-greenbee-sql-injection-in-language-tag-parameter)
- [Kados R10 GreenBee SQL injection in user2reset parameter](https://junglewise.ai/threats/cve-2019-25694-kados-r10-greenbee-sql-injection-in-user2reset-parameter)