CVE-2019-25028

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector

• CWE-80
• CWE-79

• https://github.com/vaadin/framework/pull/11644Patch, Third Party Advisory
• https://github.com/vaadin/framework/pull/11645Patch, Third Party Advisory
• https://vaadin.com/security/cve-2019-25028Vendor Advisory
• https://github.com/vaadin/framework/pull/11644Patch, Third Party Advisory
• https://github.com/vaadin/framework/pull/11645Patch, Third Party Advisory
• https://vaadin.com/security/cve-2019-25028Vendor Advisory

Published

Apr 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-25022An issue was discovered in Scytl sVote 2.1. An attacker can …9.8
• CVE-2019-25023An issue was discovered in Scytl sVote 2.1. Because the IP a…6.5
• CVE-2019-25024OpenRepeater (ORP) before 2.2 allows unauthenticated command…9.8
• CVE-2019-25025The activerecord-session_store (aka Active Record Session St…5.3
• CVE-2019-25026Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup…5.3
• CVE-2019-25027Missing output sanitization in default RouteNotFoundError vi…6.1
• CVE-2019-25029In Versa Director, the command injection is an attack in whi…9.8
• CVE-2019-2503Vulnerability in the MySQL Server component of Oracle MySQL …6.4
• CVE-2019-25030In Versa Director, Versa Analytics and VOS, Passwords are no…5.5
• CVE-2019-25031Unbound before 1.9.5 allows configuration injection in creat…5.9
• CVE-2019-25032Unbound before 1.9.5 allows an integer overflow in the regio…9.8
• CVE-2019-25033Unbound before 1.9.5 allows an integer overflow in the regio…9.8