What’s Vulnerable › Vulnerabilities

CVE-2019-25356: Bematech Printer MP-4200 TH Cross-Site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a cross-site scripting vulnerability in the admin configuration page. Attackers can inject malicious scripts via crafted POST requests with malformed 'admin' and 'person' parameters, allowing execution of arbitrary JavaScript in the context of an authenticated user's browser session.

Affected products

• Bematech MP-4200 TH: 0

References

• https://web.archive.org/web/20180814065516/https://www.bematech.com.br/
• https://www.exploit-db.com/exploits/47648
• https://www.legacyglobal.com/products/bematech-formerly-logic-controls-mp-4200-thermal-receipt-printer/?srsltid=AfmBOor3LXakwJp10bE_8n8YIBKrFPFGFc5DKrxdMGChGQ-Y24i8MVQa
• https://www.vulncheck.com/advisories/bematech-printer-mp-th-cross-site-scripting

Get alerted when CVE-2019-25356 or the next vulnerability affects your stack