PT-2026-7606 · Thesystem · Thesystem

Published 2026-02-11 · Updated 2026-03-12 · CVE-2019-25311

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions thesystem version 1.0

Description thesystem version 1.0 has a persistent cross-site scripting issue. Attackers can inject malicious scripts through several server data input fields. Specifically, crafted script payloads can be submitted in the following parameters to execute arbitrary JavaScript in victim browsers: operating system, system owner, system username, system password, system description, and server name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25311

Affected Products

Thesystem

References · 7

• 🔥 https://exploit-db.com/exploits/47440 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25311 · Security Note
• https://github.com/kostasmitroglou/thesystem · Note
• https://vulncheck.com/advisories/thesystem-persistent-xss · Note
• https://t.me/cveNotify/155338 · Telegram Post
• https://t.me/CVEtracker/44425 · Telegram Post