CVE-2019-25312 MEDIUM

CVE-2019-25312: InoERP 0.7.2 - Persistent Cross-Site Scripting

Vendor Inoideas

Product InoERP

Weakness CWE-79 · XSS

Published February 11, 2026

Last update March 5, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session information.

Key dates

02Disclosure timeline

February 11, 2026 CVE published

March 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25312 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-3732 GeoDirectory – WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode CVE-2024-36170 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2024-35225 Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2021-24305 Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key CVE-2024-51700 WordPress NAVER Analytics plugin <= 0.9 - CSRF to Stored XSS vulnerability