CVE-2019-25676 - CVE House
Back to Database
Status published High CVE-2019-25676

Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection

Vulnerability Description

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view parameter in list-details.php to execute arbitrary code or extract database information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25676

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mr Winst0n

References

More from Phpscriptsmall

View All →
CVE-2019-25680
Advance Gift Shop Pro Script 2.0.3 SQL Injection via search
High 8.8
CVE-2019-25668
News Website Script 2.0.5 SQL Injection via index.php
High 8.8
CVE-2019-25445
Fiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.php
Medium 5.1
CVE-2019-25444
Fiverr Clone Script 1.2.2 SQL Injection via page Parameter
High 8.8

Affected Vendor

Phpscriptsmall

View all reports →

Affected Software

Ask Expert Script
Vulnerable Versions:
3.0.5

Timeline

Official Publish: April 5th, 2026
Last Modified: April 6th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact