CVE-2019-25253

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with external entity references to retrieve sensitive configuration data like database credentials through an out-of-band channel attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
KYOCERA Corporation	KYOCERA Net Admin	3.4.0906

References

https://global.kyocera.comProduct
https://www.exploit-db.com/exploits/44430Exploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5459.phpExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5459.phpExploit, Third Party Advisory

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-252548.8KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without CVE-2019-252554.3VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute s CVE-2019-252566.5VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbi CVE-2019-252576.5LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary p CVE-2019-252587.5LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary fil CVE-2019-252595.3Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform admi CVE-2019-25267.8Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are CVE-2019-252608.2OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert mal CVE-2019-252617.8AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentiall CVE-2019-252623.5A security vulnerability has been detected in elinicksic Razgover up to db37dfc5c82f023a40f2f7834ded6633fb2b5262. This affects an unknown pa CVE-2019-252636.4Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts thro CVE-2019-252646.4Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embe