Back
CVE-2019-25277
FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php
Medium5.1EPSS 0.32%
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| VulnCheckCNA (assigner) | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Analyzed | 4.0 | Medium5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.32% · top 75% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Weakness
Affected products
iWT Ltd. · FaceSentry Access Control System
- affected 6.4.8
- affected 5.7.2
- affected 5.7.0
References (4)
- Zero Science Lab Vulnerability Advisory (opens in a new tab)third-party-advisoryexploit
- Packet Storm Security Exploit Entry (opens in a new tab)exploit
- CXSecurity Vulnerability Listing (opens in a new tab)third-party-advisory
- IBM X-Force Vulnerability Exchange (opens in a new tab)vdb-entry
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-25277)Record last updated .