How severe is CVE-2019-25613?

CVE-2019-25613 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-25613 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-25613?

CVE-2019-25613 affects Echatserver Easy Chat Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-25613?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2019-25613 have an EU (EUVD) identifier?

Yes. CVE-2019-25613 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-19967.

When was CVE-2019-25613 published?

CVE-2019-25613 was published on 2026-03-22 and last updated on 2026-06-17.

CVE-2019-25613

CVE-2019-25613 is a high-severity vulnerability in Echatserver Easy Chat Server with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-940.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v4: 8.7
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2019-19967
Weakness: CWE-940
Affected product: Echatserver Easy Chat Server
Published: 2026-03-22
Last modified: 2026-06-17

Description

Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message parameter. Attackers can establish a session via the chat.ghp endpoint and then send a POST request to body2.ghp with an excessively large message parameter value to cause the service to crash.

Frequently asked questions

What is CVE-2019-25613?: Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message parameter. Attackers can establish a session via the chat.ghp endpoint and then send a POST request to body2.ghp with an excessively large message parameter value to cause the service to crash.
How severe is CVE-2019-25613?: CVE-2019-25613 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-25613 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-25613?: CVE-2019-25613 affects Echatserver Easy Chat Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-25613?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2019-25613 have an EU (EUVD) identifier?: Yes. CVE-2019-25613 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2019-19967.
When was CVE-2019-25613 published?: CVE-2019-25613 was published on 2026-03-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:echatserver:easy_chat_server:3.1:*:*:*:*:*:*:*

More vulnerabilities in Echatserver Easy Chat Server

CVE-2018-25221 — Critical (CVSS 9.8): EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to…
CVE-2017-9544 — Critical (CVSS 9.8): There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to…
CVE-2022-44939 — High (CVSS 7.8): Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component…
CVE-2019-20502 — High (CVSS 7.5): An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter.
CVE-2017-9557 — High (CVSS 7.5): register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by…
CVE-2017-9543 — High (CVSS 7.5): register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords…

All CVEs affecting Echatserver Easy Chat Server →

Other CWE-940 vulnerabilities

CVE-2025-61932 — Critical (CVSS 9.8): Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin…
CVE-2024-38886 — Critical (CVSS 9.8): An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions,…
CVE-2024-40515 — Critical (CVSS 9.8): An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute…
CVE-2023-41355 — Critical (CVSS 9.8): Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages.…
CVE-2026-48745 — Critical (CVSS 9.3): Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source…
CVE-2026-33875 — Critical (CVSS 9.3): Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0…

Browse all CWE-940 vulnerabilities →