CVE-2019-25265 | THREATINT

Description

Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.

PUBLISHED Reserved 2026-01-06 | Published 2026-02-03 | Updated 2026-02-06 | Assigner VulnCheck

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

3.2

affected

Credits

Cemal Cihad ÇİFTÇİ finder

References

www.exploit-db.com/exploits/47725 (ExploitDB-47725) exploit

bigprof.com (Vendor Homepage) product

bigprof.com/appgini/applications/online-inventory-manager (Software Download Page) product

www.vulncheck.com/...manager-persistent-cross-site-scripting (VulnCheck Advisory: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting) third-party-advisory

cve.org (CVE-2019-25265)

nvd.nist.gov (CVE-2019-25265)

Download JSON