CVE-2019-25316: GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting

Published Feb 11, 2026

Updated

GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title parameter. Attackers can exploit the CreateEvent.php endpoint by sending crafted POST requests with XSS payloads to execute arbitrary JavaScript in victim browsers.

Affected Software

1 affected component

GoAutoDial GOautodial

Event History

Feb 11, 2026

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-25316?

The severity of CVE-2019-25316 is classified as medium due to its potential impact on affected systems.

How do I fix CVE-2019-25316?

To fix CVE-2019-25316, ensure that input validation and output encoding are applied to the event title parameter.

Who is affected by CVE-2019-25316?

GOautodial 4.0 is the affected software version vulnerable to CVE-2019-25316.

What type of vulnerability is CVE-2019-25316?

CVE-2019-25316 is a persistent cross-site scripting (XSS) vulnerability.

What is the exploit method for CVE-2019-25316?

The exploit method for CVE-2019-25316 involves injecting malicious scripts through the CreateEvent.php endpoint using the event title parameter.