CVE-2019-25250
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Dec 24, 2025
CISA due date
—
The record
Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that trigger unauthorized configuration changes by exploiting predictable URL actions when a logged-in user visits the site.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352
- CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows… CWE-352
- CVE-2026-119466 Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for… CWE-352
- CVE-2026-45141 Chamilo LMS is an open-source learning management system. CWE-352
- CVE-2026-112374 FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff… CWE-352
- CVE-2026-119426 phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows… CWE-352
- CVE-2026-119407 Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment… CWE-352
- CVE-2026-118570 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site… CWE-352