CVE-2019-25233

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

CVSS v4.0

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2025-12-24

Updated

2026-07-28

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47821

References

• CVE Record
• NVD entry

Related

• CVE-2019-25232
• CVE-2019-25234
• CVE-2019-25231
• CVE-2019-25235
• CVE-2019-25227
• CVE-2019-25236