What is CVE-2019-25233?

CVE-2019-25233 is a medium-severity vulnerability in Ave S.p.a. Dominaplus, classified under Cross-site Scripting. CVSS score: 5.3/10. Published 2025-12-24.

How severe is CVE-2019-25233?

Medium severity. CVSS v3 base score is 5.3 out of 10.

XSS in Ave S.p.a. Dominaplus

CVE-2019-25233

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (8.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Ave S.p.a. Dominaplus — versions Web Server Code 53AB-WBS - 1.10.62

Weakness classification (CWE)

References

ExploitDB-47821 (exploit)
AVE S.p.A. Official Website (product)
DOMINAplus Product Page (product)
Zero Science Lab Disclosure (ZSL-2019-5547) (third-party-advisory)

Frequently asked questions

What is CVE-2019-25233?: CVE-2019-25233 is a medium-severity vulnerability in Ave S.p.a. Dominaplus, classified under Cross-site Scripting. CVSS score: 5.3/10. Published 2025-12-24.
How severe is CVE-2019-25233?: Medium severity. CVSS v3 base score is 5.3 out of 10.