CVE-2019-25502

MEDIUM

simplejobscript < 1.66 - Unauthenticated Stored Cross-Site Scripting via Job Type Value Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-25502. PoCs published by Ahmet Ümit BAYRAM.

AI-analyzed exploit summary The exploit demonstrates multiple SQL injection and XSS vulnerabilities in Simple Job Script. It includes functional payloads for SQLi via POST parameters and an XSS payload via a GET parameter.

Description

Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the job_type_value parameter in the jobs endpoint. Attackers can craft requests with SVG payload injection to execute arbitrary JavaScript in victim browsers and steal session cookies or perform unauthorized actions.

Exploits (1)

exploitdb WORKING POC
by Ahmet Ümit BAYRAM · textwebappsphp
https://www.exploit-db.com/exploits/46612

The exploit demonstrates multiple SQL injection and XSS vulnerabilities in Simple Job Script. It includes functional payloads for SQLi via POST parameters and an XSS payload via a GET parameter.

Classification
Working Poc 95%
Attack Type
Sqli | Xss
Complexity
Trivial
Reliability
Reliable
Target: Simple Job Script (Latest)
No auth needed
Prerequisites: Access to the target application
devstral-2 · analyzed Mar 05, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/46612

Scores

CVSS v3 6.1
EPSS 0.0025
EPSS Percentile 16.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
niteosoft/Simple Job Script 1.66
simplejobscript/simplejobscript < 1.66
Published Mar 04, 2026
Tracked Since Mar 05, 2026