Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cd2n-d7w1-mfc6
Vulnerability ID VCID-cd2n-d7w1-mfc6
Aliases CVE-2019-25027
GHSA-rp4x-wxqv-cf9m
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-81 Improper Neutralization of Script in an Error Message Web Page
System Score Found at
epss 0.00371 https://api.first.org/data/v1/epss?cve=CVE-2019-25027
cvssv3.1 6.1 https://github.com/vaadin/flow/pull/5498
generic_textual MODERATE https://github.com/vaadin/flow/pull/5498
cvssv3.1 6.1 https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m
generic_textual MODERATE https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2019-25027
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2019-25027
cvssv3.1 6.1 https://vaadin.com/security/cve-2019-25027
generic_textual MODERATE https://vaadin.com/security/cve-2019-25027
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-25027
https://github.com/vaadin/flow/pull/5498
CVE-2019-25027 https://nvd.nist.gov/vuln/detail/CVE-2019-25027
CVE-2019-25027 https://vaadin.com/security/cve-2019-25027
GHSA-rp4x-wxqv-cf9m https://github.com/advisories/GHSA-rp4x-wxqv-cf9m
GHSA-rp4x-wxqv-cf9m https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/vaadin/flow/pull/5498
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/vaadin/flow/security/advisories/GHSA-rp4x-wxqv-cf9m
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-25027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://vaadin.com/security/cve-2019-25027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.59216
EPSS Score 0.00371
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:21:03.103240+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow-server/CVE-2019-25027.yml 38.6.0