GCVE - cpe:2.3:a:kostasmitroglou:thesystem:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:kostasmitroglou:thesystem:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Kostasmitroglou (`5b38afa8-1bdb-53fc-bd2c-8161e72987e8`)
Product	Thesystem (`f0e50e84-0bce-5380-918d-e797c42d9420`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/kostasmitroglou/thesystem`	purl2cpe	2026-06-01 10:12:19.262145

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-25441`	vulnerable	2026-06-08 05:13:42.369164	thesystem 1.0 Command Injection via run_command endpoint CRITICAL (9.8) thesystem 1.0 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the run_command endpoint. Attackers can send POST requests with shell commands in the command parameter to execute arbitrary code on the server without authentication. Published: 2026-02-20T22:54:52.006Z Updated: 2026-04-07T14:04:05.876Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/47441 https://github.com/kostasmitroglou/thesystem https://www.vulncheck.com/advisories/thesystem-command-injection-via-runcommand-endpoint	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25347`	vulnerable	2026-06-08 05:13:42.269654	thesystem App 1.0 - 'username' SQL Injection HIGH (7.5) thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts. Published: 2026-02-12T19:02:36.324Z Updated: 2026-03-02T14:49:37.130Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/47432 https://github.com/kostasmitroglou/thesystem https://www.vulncheck.com/advisories/thesystem-app-username-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25346`	vulnerable	2026-06-08 05:13:42.268340	thesystem 1.0 - 'server_name' SQL Injection HIGH (7.5) TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information. Published: 2026-02-12T19:02:35.562Z Updated: 2026-03-02T14:49:36.953Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/47430 https://github.com/kostasmitroglou/thesystem https://www.vulncheck.com/advisories/thesystem-servername-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25311`	vulnerable	2026-06-08 05:13:42.211542	thesystem Persistent XSS MEDIUM (6.4) thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data input fields. Attackers can submit crafted script payloads in operating_system, system_owner, system_username, system_password, system_description, and server_name parameters to execute arbitrary JavaScript in victim browsers. Published: 2026-02-11T14:56:52.503Z Updated: 2026-02-11T16:03:20.025Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/47440 https://github.com/kostasmitroglou/thesystem https://www.vulncheck.com/advisories/thesystem-persistent-xss	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.