Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-19245: NAPC Xinet Elegant 6 Asset Library permits SQL injection

CVE-2019-19245 · published 6 years ago

Summary

The login screen of NAPC Xinet Elegant 6 Asset Library (version 6.1.655) accepts specially crafted input that lets an unauthenticated user run database commands. This could allow an attacker to view, change or delete stored information. Apply the vendor’s update or patch immediately and ensure input validation or a web firewall is in place.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
napc	xinet_elegant_6_asset_library	6.1.655 `cpe:2.3:a:napc:xinet_elegant_6_asset_library:6.1.655:::::::*`

Original advisory text

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.

References

http://hyp3rlinx.altervista.org Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2025/Feb/0
https://packetstormsecurity.com/files/155505/Xinet-Elegant-6-Asset-Library-Web-I... Exploit Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

8% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published2 Dec 2019

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2019-19245 · NVD

Track software like this

Free during beta