PT-2026-30484 · Php Scripts Mall · Ask Expert Script

Mr Winst0N · CVE-2019-25676 · Published 2026-04-05 · Updated 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ask Expert Script version 3.0.5

Description Unauthenticated attackers can inject malicious code by manipulating URL parameters. The issue involves cross-site scripting (XSS), where script tags can be injected via the cateid parameter in the 'categorysearch.php' endpoint, and SQL injection, where SQL code can be injected via the view parameter in the 'list-details.php' endpoint to execute arbitrary code or extract database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the cateid parameter in the 'categorysearch.php' endpoint. Avoid using the view parameter in the 'list-details.php' endpoint.

Exploit

SQL injection

XSS

Weakness Enumeration

CWE-89

CWE-79

Related Identifiers

CVE-2019-25676

Affected Products

Ask Expert Script

References · 4

• 🔥 https://exploit-db.com/exploits/46426 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25676 · Security Note
• http://phpscriptsmall.com · Note
• https://vulncheck.com/advisories/ask-expert-script-cross-site-scripting-sql-injection · Note