CVE-2019-25434

SpotAuditor 5.3.1.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Attackers can enter a large string of characters (5000 bytes or more) in the name field during registration to trigger an unhandled exception that crashes the application.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.nsauditor.com	Product
https://www.exploit-db.com/exploits/47494	Exploit VDB Entry
https://www.vulncheck.com/advisories/spotauditor-denial-of-service-via-registration-name-field	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nsasoft:spotauditor:*:*:*:*:*:*:*:*

History

05 Mar 2026, 01:05

Type	Values Removed	Values Added
Summary		(es) SpotAuditor 5.3.1.0 contiene una vulnerabilidad de denegación de servicio que permite a atacantes no autenticados provocar la caída de la aplicación al enviar datos excesivos en el campo de nombre de registro. Los atacantes pueden introducir una cadena grande de caracteres (5000 bytes o más) en el campo de nombre durante el registro para activar una excepción no controlada que provoca la caída de la aplicación.
CPE		cpe:2.3:a:nsasoft:spotauditor::::::::
First Time		Nsasoft Nsasoft spotauditor
References	~~() http://www.nsauditor.com -~~	() http://www.nsauditor.com - Product
References	~~() https://www.exploit-db.com/exploits/47494 -~~	() https://www.exploit-db.com/exploits/47494 - Exploit, VDB Entry
References	~~() https://www.vulncheck.com/advisories/spotauditor-denial-of-service-via-registration-name-field -~~	() https://www.vulncheck.com/advisories/spotauditor-denial-of-service-via-registration-name-field - Third Party Advisory

20 Feb 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-20 23:16

Updated : 2026-03-05 01:05

NVD link : CVE-2019-25434

Mitre link : CVE-2019-25434

CVE.ORG link : CVE-2019-25434

JSON object : View

Products Affected

nsasoft

spotauditor

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2019-25434", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-20T23:16:00.037", "references": [{"url": "http://www.nsauditor.com", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/47494", "tags": ["Exploit", "VDB Entry"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/spotauditor-denial-of-service-via-registration-name-field", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "SpotAuditor 5.3.1.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Attackers can enter a large string of characters (5000 bytes or more) in the name field during registration to trigger an unhandled exception that crashes the application."}, {"lang": "es", "value": "SpotAuditor 5.3.1.0 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a atacantes no autenticados provocar la ca\u00edda de la aplicaci\u00f3n al enviar datos excesivos en el campo de nombre de registro. Los atacantes pueden introducir una cadena grande de caracteres (5000 bytes o m\u00e1s) en el campo de nombre durante el registro para activar una excepci\u00f3n no controlada que provoca la ca\u00edda de la aplicaci\u00f3n."}], "lastModified": "2026-03-05T01:05:22.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nsasoft:spotauditor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A97BC20D-9434-420C-8F44-7AB6D0946AAC", "versionEndIncluding": "5.3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}