CVE-2019-25612

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Admin Express 1.2.5.485 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an alphanumeric encoded payload in the Folder Path field. Attackers can trigger the vulnerability through the System Compare feature by pasting a crafted buffer overflow payload into the left-hand side Folder Path field and clicking the scale icon to execute shellcode with application privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Mar 22, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2019

CVE-2019-256137.5Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized dCVE-2019-256149.8Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary coCVE-2019-256158.4Lavavo CD Ripper 4.20 contains a structured exception handling (SEH) buffer overflow vulnerability that allows local attackers to execute arCVE-2019-256166.2AnMing MP3 CD Burner 2.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversCVE-2019-256176.2Ease Audio Converter 5.30 contains a denial of service vulnerability in the Audio Cutter function that allows local attackers to crash the aCVE-2019-256186.2AdminExpress 1.2.5 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized iCVE-2019-256197.8FTP Shell Server 6.83 contains a buffer overflow vulnerability in the 'Account name to ban' field that allows local attackers to execute arbCVE-2019-256205.5Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed inpuCVE-2019-256215.5Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed inpCVE-2019-256225.5Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed inpCVE-2019-256235.5Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformedCVE-2019-256245.5Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed in
CVE-2019-25612: High severity, CVSS 7.8 | Vulnix