CVE-2019-25265 - Online Inventory Manager 3.2 - Persistent Cross-Site Scripting

Back Back to CVE browser

MEDIUM

Online Inventory Manager 3.2 - Persistent Cross-Site Scripting

Published Feb 3, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.33%

Description

Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers can inject malicious JavaScript through the description field that will execute when the groups page is viewed, allowing potential cookie theft and client-side script execution.

Affected products

Vendor Bigprof Product Online Inventory Manager Default
n/a
- Version
  3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bigprof

Online Inventory Manager

n/a

Version	Status	Constraints
3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://bigprof.com
product
https://bigprof.com/appgini/applications/online-inventory-manager
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19380
Advisory
https://www.exploit-db.com/exploits/47725
exploit
https://www.vulncheck.com/advisories/online-inventory-manager-persistent-cross-site-scripting
third-party-advisory

Link	Providers	Tags
https://bigprof.com		product
https://bigprof.com/appgini/applications/online-inventory-manager		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19380		Advisory
https://www.exploit-db.com/exploits/47725		exploit
https://www.vulncheck.com/advisories/online-inventory-manager-persistent-cross-site-scripting		third-party-advisory