CVE-2019-25280: Yahei-PHP Prober 0.4.7 Remote HTML Injection via Speed Parameter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-08 · updated 2026-06-17
Weakness: CWE-79

Description

Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the 'speed' GET parameter. Attackers can inject malicious HTML code in the 'speed' parameter of prober.php to trigger cross-site scripting in user browser sessions.

Affected products

Yahei.Net Yahei-PHP Prober: 0.4.7

References

https://cxsecurity.com/issue/WLB-2019070132
https://exchange.xforce.ibmcloud.com/vulnerabilities/164412
https://packetstormsecurity.com/files/153756
https://web.archive.org/web/20190623143100/http://www.yahei.net/
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5531.php
https://cxsecurity.com/issue/WLB-2019070132
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5531.php

Get alerted when CVE-2019-25280 or the next vulnerability affects your stack