CVE-2019-25277

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.

Affected

iWT Ltd. · FaceSentry Access Control System

CVSS v4.0 VULNCHECK

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 24th percentile

Published

2026-01-07

Updated

2026-05-24

Proof-of-concept exploits (1)

• https://packetstormsecurity.com/files/153494

Security advisories

• https://cxsecurity.com/issue/WLB-2019070017
• https://exchange.xforce.ibmcloud.com/vulnerabilities/163191
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5527.php

References

• CVE Record
• NVD entry