{"api_version":"1","generated_at":"2026-07-23T12:05:40+00:00","cve":"CVE-2019-5070","urls":{"html":"https://cve.report/CVE-2019-5070","api":"https://cve.report/api/cve/CVE-2019-5070.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-5070","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-5070"},"summary":{"title":"CVE-2019-5070","description":"An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.","state":"PUBLIC","assigner":"talos-cna@cisco.com","published_at":"2019-09-05 17:15:00","updated_at":"2022-06-27 17:27:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0859","name":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0859","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"TALOS-2019-0859 ||  Cisco Talos Intelligence Group - Comprehensive Threat Intelligence","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5070","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5070","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"5070","vulnerable":"1","versionEndIncluding":"5.2.12","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"epignosishq","cpe5":"efront_lms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2019-5070","ASSIGNER":"talos-cna@cisco.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"Epignosis","version":{"version_data":[{"version_value":"Epignosis eFront LMS v5.2.12"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}]},"references":{"reference_data":[{"refsource":"MISC","name":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0859","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0859"}]},"description":{"description_data":[{"lang":"eng","value":"An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required."}]},"impact":{"cvss":{"baseScore":6.5,"baseSeverity":"Medium","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.0"}}},"nvd":{"publishedDate":"2019-09-05 17:15:00","lastModifiedDate":"2022-06-27 17:27:00","problem_types":["CWE-89"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:epignosishq:efront_lms:*:*:*:*:*:*:*:*","versionEndIncluding":"5.2.12","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"5070","Ordinal":"142686","Title":"CVE-2019-5070","CVE":"CVE-2019-5070","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"5070","Ordinal":"1","NoteData":"An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. Specially crafted web request to login page can cause SQL injections, resulting in data compromise. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"5070","Ordinal":"2","NoteData":"2019-09-05","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"5070","Ordinal":"3","NoteData":"2019-09-05","Type":"Other","Title":"Modified"}]}}}