CVE-2019-25255

VideoFlow Digital Video Protection DVP 2.10 Authenticated Remote Code Execution

High8.7EPSS 0.44%

Published: 24 Dec 2025
Updated: 28 Jul 2026
Reserved: 24 Dec 2025
Assigned by: VulnCheck

Description

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with root privileges. Attackers can exploit the vulnerability through a cross-site request forgery (CSRF) mechanism to gain unauthorized system access.

Scores

CVSS scores of CVE-2019-25255, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVDNVD · Deferred	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.44% · top 61% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

VideoFlow Ltd. · VideoFlow Digital Video Protection DVP
- affected 2.10
- affected 1.40.0.15
- affected 2.10.0.5

References (3)

ExploitDB-44387 (opens in a new tab)exploit
VideoFlow Official Product Homepage (opens in a new tab)productexploit
Zero Science Lab Disclosure (ZSL-2018-5455) (opens in a new tab)third-party-advisoryexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25255](https://trackcve.app/badge/CVE-2019-25255.svg)](https://trackcve.app/cve/CVE-2019-25255)

Record last updated 28 Jul 2026, 01:46 UTC.