CVE-2019-25270

🗓️ 07 Jan 2026 23:11:06Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

CVE-2019-25270: XSS in senddata parameter of logged_page.php enables running arbitrary code in a victim browser.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2019-25270	8 Jan 202621:03	–	circl
CNNVD	SOCA Access Control System 跨站脚本漏洞	8 Jan 202600:00	–	cnnvd
Cvelist	CVE-2019-25270 SOCA Access Control System 180612 Reflected Cross-Site Scripting via logged_page.php	7 Jan 202623:11	–	cvelist
NVD	CVE-2019-25270	8 Jan 202600:15	–	nvd
Positive Technologies	PT-2026-1674	7 Jan 202600:00	–	ptsecurity
Vulnrichment	CVE-2019-25270 SOCA Access Control System 180612 Reflected Cross-Site Scripting via logged_page.php	7 Jan 202623:11	–	vulnrichment
Zero Science Lab	SOCA Access Control System 180612 Reflected Cross-Site Scripting	13 May 201900:00	–	zeroscience

Vulners

Node

soca_technology_co.,_ltd soca_access_control_systemMatch180612

soca_technology_co.,_ltd soca_access_control_systemMatch170000

soca_technology_co.,_ltd soca_access_control_systemMatch141007

[
  {
    "vendor": "SOCA Technology Co., Ltd",
    "product": "SOCA Access Control System",
    "versions": [
      {
        "version": "180612",
        "status": "affected"
      },
      {
        "version": "170000",
        "status": "affected"
      },
      {
        "version": "141007",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/160976
socatech	www.socatech.com/
packetstormsecurity	www.packetstormsecurity.com/files/152837
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5518.php
cxsecurity	www.cxsecurity.com/issue/WLB-2019050151

Parameter	Position	Path	Description	CWE
senddata	request body	Login/logged-page.php	Reflected XSS: unsanitized senddata in logged-page.php allows injected HTML/JS to run in victim's browser	CWE-79

17 Jun 2026 02:31Current

6.2Medium risk

Vulners AI Score6.2

CVSS 45.1

CVSS 3.16.1

EPSS0.00198

SSVC

CWE-79