CVE-2019-25316

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title parameter. Attackers can exploit the CreateEvent.php endpoint by sending crafted POST requests with XSS payloads to execute arbitrary JavaScript in victim browsers.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2019

CVE-2019-253175.4Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptio CVE-2019-253188.8AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the ou CVE-2019-253199.8Domain Quester Pro 6.02 contains a stack overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Struct CVE-2019-25324.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affect CVE-2019-253206.5E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credential CVE-2019-253219.8FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Excepti CVE-2019-253227.5Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentia CVE-2019-253236.1Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HT CVE-2019-253246.1RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to injec CVE-2019-253258.2Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass CVE-2019-253265.5ipPulse 1.92 contains a denial of service vulnerability that allows local attackers to crash the application by providing an oversized input CVE-2019-253279.8Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arb