CVE-2019-25233mediumCWE-352CWE-79

CVE-2019-25233: medium-severity vulnerability in AVE S.p.A. DOMINAplus

AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities

Published · Updated

Follow this CVE+ Monitor DOMINAplus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
AVE S.p.A. · DOMINAplus