CVE-2019-25676

HighPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

20 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0046 36.7th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2019-25676 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Phpscriptsmall Ask Expert Script. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2019-25676 is a high-severity vulnerability (CVSS v3.1 score of 8.2; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) affecting Ask Expert Script version 3.0.5, involving cross-site scripting (CWE-79) and SQL injection (CWE-89) flaws. The XSS issue arises in the "cateid" parameter of categorysearch.php, where attackers can inject script tags. The SQL injection vulnerability exists in the "view" parameter of list-details.php, enabling injection of SQL code.

Unauthenticated remote attackers can exploit these issues with low complexity over the network. By manipulating the specified URL parameters, they can inject malicious script tags to execute arbitrary JavaScript in victims' browsers or inject SQL code to execute arbitrary queries, potentially extracting sensitive database information.

Advisories from VulnCheck (https://www.vulncheck.com/advisories/ask-expert-script-cross-site-scripting-sql-injection) and a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/46426) detail the vulnerabilities, with the vendor site at http://www.phpscriptsmall.com/ also referenced. No specific patch or mitigation guidance is outlined in the provided details.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2019-20087

Vulnerability details

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view…

parameter in list-details.php to execute arbitrary code or extract database information.

CWE(s): CWE-79 CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Unauthenticated remote exploitation of public-facing PHP web application via XSS and SQL injection directly enables T1190. SQL injection allows arbitrary database queries for sensitive data extraction, facilitating T1213.006.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0