CVE-2019-25233

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-352
Published: 2025-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.ave.it
https://www.domoticaplus.it
https://www.exploit-db.com/exploits/47821
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5547.php

Check your stack JSON