CVE-2019-25323
Heatmiser Netmonitor 3.03 - HTML Injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 12, 2026
- Updated
- Feb 13, 2026
- Reserved
- Feb 12, 2026
Description
Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and potentially manipulate the web interface's displayed content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Heatmiser NetmonitorHeatmiser |
|
References
- ExploitDB-47828exploit
- Archived Heatmiser Official Websiteproduct
- Heatmiser Netmonitor User Manualproduct
- VulnCheck Advisory: Heatmiser Netmonitor 3.03 - HTML Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.