Medium severity5.4NVD Advisory· Published Feb 11, 2026· Updated Jun 17, 2026

CVE-2019-25312

Description

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

InoERP/InoERPllm-fuzzy
Range: <0.7.2
Inoideas/Inoerpcpe-rescue2 versions
0.7.2+ 1 more
- (no CPE)range: 0.7.2
- cpe:2.3:a:inoideas:inoerp:0.7.2:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/47428nvdExploit
www.vulncheck.com/advisories/inoerp-persistent-cross-site-scriptingnvdThird Party Advisory
inoideas.orgnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000