CVE-2019-25233

AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities

State: Published
Severity: 5.1 Medium
Published: Dec 24, 2025
Updated: Jul 28, 2026
Reserved: Dec 24, 2025

Description

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
DOMINAplusAVE S.p.A.	Web Server Code 53AB-WBS - 1.10.62Affected

References

ExploitDB-47821exploit
AVE S.p.A. Official Websiteproduct
DOMINAplus Product Pageproduct
Zero Science Lab Disclosure (ZSL-2019-5547)third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.