CVE-2019-25277
FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jan 7, 2026
- Updated
- May 24, 2026
- Reserved
- Jan 6, 2026
Description
FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
FaceSentry Access Control SystemiWT Ltd. |
|
References
- Zero Science Lab Vulnerability Advisorythird-party-advisory
- Packet Storm Security Exploit Entryexploit
- CXSecurity Vulnerability Listingthird-party-advisory
- IBM X-Force Vulnerability Exchangevdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.