CVE-2019-25277

MEDIUM EPSS 19.5%

Published Jan 8, 20265mo ago · Modified Jun 17, 20261w ago

5.1 CVSS 4.0

Medium

Published Jan 8, 2026 5mo ago

Last Modified Jun 17, 2026 1w ago

Description

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.

CVSS Details

Base Score

5.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

19.5% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 4

Vendor	Product	Version	Range
iwt	facesentry_access_control_system_firmware	5.7.0	any
iwt	facesentry_access_control_system_firmware	5.7.2	any
iwt	facesentry_access_control_system_firmware	6.4.8	any
iwt	facesentry_access_control_system	*	any

References 4

cxsecurity.com https://cxsecurity.com/issue/WLB-2019070017

Third Party Advisory
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/163191

Third Party Advisory
packetstormsecurity.com https://packetstormsecurity.com/files/153494

Third Party Advisory
zeroscience.mk https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5527.php

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.