← Zuruck zu CVEs

CVE-2019-25277

MEDIUM

6.1

Beschreibung

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.

CVE Details

CVSS v3.1 Bewertung6.1

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht1/8/2026

Zuletzt geandert1/22/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

iwt:facesentry_access_control_systemiwt:facesentry_access_control_system_firmware

Schwachen (CWE)

CWE-79

Referenzen

https://cxsecurity.com/issue/WLB-2019070017(disclosure@vulncheck.com)

https://exchange.xforce.ibmcloud.com/vulnerabilities/163191(disclosure@vulncheck.com)

https://packetstormsecurity.com/files/153494(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5527.php(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5527.php(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.