What’s Vulnerable › Vulnerabilities

CVE-2019-25502: Simple Job Script Cross-Site Scripting via job_type_value Parameter

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-04 · updated 2026-06-17
• Weakness: CWE-79

Description

Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the job_type_value parameter in the jobs endpoint. Attackers can craft requests with SVG payload injection to execute arbitrary JavaScript in victim browsers and steal session cookies or perform unauthorized actions.

Affected products

• niteosoft Simple Job Script: through 1.66

References

• https://www.exploit-db.com/exploits/46612
• https://www.vulncheck.com/advisories/simple-job-script-cross-site-scripting-via-job-type-value-parameter

Get alerted when CVE-2019-25502 or the next vulnerability affects your stack