PT-2026-1674 · Unknown · Soca Access Control System

CVE-2019-25270 · Publicado 2026-01-07 · Atualizado 2026-01-08

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOCA Access Control System version 180612

Description The SOCA Access Control System contains a cross-site scripting issue in the senddata POST parameter of the 'logged page.php' file. This allows attackers to inject malicious scripts by sending crafted POST requests, potentially executing arbitrary HTML and script code within a victim’s browser session. The API endpoint involved is 'logged page.php'. The vulnerable parameter is senddata.

Recommendations Apply input validation and output encoding to the senddata POST parameter in the 'logged page.php' file to prevent the injection of malicious scripts. As a temporary workaround, consider restricting access to the 'logged page.php' file to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25270

Produtos afetados

Soca Access Control System

Referências · 8

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5518.php · Exploit
• 🔥 https://packetstormsecurity.com/files/152837 · Exploit
• https://t.me/CVEtracker/41649 · Publicação no Telegram
• https://socatech.com · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/160976 · Nota
• https://t.me/cveNotify/148021 · Publicação no Telegram
• https://cxsecurity.com/issue/WLB-2019050151 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25270 · Nota de Segurança