Vendor Homepageproduct
https://bigprof.com/ CVE-2019-25265
MEDIUM
Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
Record summary
CVE-2019-25265 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 6, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Online Inventory ManagerBrowse Bigprof / Online Inventory Manager | CVE List | 3.2 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBOnline Inventory Manager 3.2 - Persistent Cross-Site ScriptingExploitDB exploitby Cemal Cihad ÇİFTÇİNot analyzed1 file
References
5Software Download Pageproduct
https://bigprof.com/appgini/applications/online-inventory-manager nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25265 ExploitDB-47725exploit
https://www.exploit-db.com/exploits/47725 VulnCheck Advisory: Online Inventory Manager 3.2 - Persistent Cross-Site ScriptingThird-party advisory
https://www.vulncheck.com/advisories/online-inventory-manager-persistent-cross-site-scripting