CVE-2019-25676: phpscriptsmall ask expert script

csirt@kutim:~/threat-intel/cve/CVE-2019-25676

CVSS 9.8 · Critical EPSS 0,46%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada phpscriptsmall ask expert script. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipulating URL parameters. Attackers can inject script tags through the cateid parameter in categorysearch.php or SQL code through the view parameter in list-details.php to execute arbitrary code or extract database information.

Rincian

Terbit di NVD: 5 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
EPSS (30 hari): 0,46% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
phpscriptsmall	ask expert script	Versi 3.0.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.vulncheck.com/advisories/ask-expert-script-cross-site-scripting-sql-injection advisory pihak ketiga
https://www.exploit-db.com/exploits/46426 exploit · vdb entry
http://www.phpscriptsmall.com/ product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.