2019 CVEs (page 5)
Page 5 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25381 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers t… |
CVE-2019-25380 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dhcp.cgi script that allow attackers to… |
CVE-2019-25379 | High | 7.2 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains stored and reflected cross-site scripting vulnerabilities in the urlfilter.cgi endpoint that allow att… |
CVE-2019-25378 | Medium | 6.1 | 2026-02-16 | Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple cross-site scripting vulnerabilities in the proxy.cgi endpoint that allow attackers to inject… |
CVE-2019-25377 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scri… |
CVE-2019-25376 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted p… |
CVE-2019-25375 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted i… |
CVE-2019-25374 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks… |
CVE-2019-25373 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input… |
CVE-2019-25372 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25371 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insuffici… |
CVE-2019-25370 | Medium | 6.1 | 2026-02-15 | OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through mul… |
CVE-2019-25369 | Medium | 6.4 | 2026-02-15 | OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malici… |
CVE-2019-25368 | Medium | 5.4 | 2026-02-15 | OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through m… |
CVE-2019-25367 | Medium | 5.4 | 2026-02-15 | ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user… |
CVE-2019-25342 | High | 7.5 | 2026-02-12 | Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endp… |
CVE-2019-25341 | High | 7.5 | 2026-02-12 | iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input. At… |
CVE-2019-25340 | High | 7.5 | 2026-02-12 | SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the application by supplying an ov… |
CVE-2019-25339 | High | 7.5 | 2026-02-12 | GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application. Attackers can pas… |
CVE-2019-25338 | Medium | 5.3 | 2026-02-12 | DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. A… |
CVE-2019-25337 | Critical | 9.8 | 2026-02-12 | OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Att… |
CVE-2019-25336 | High | 8.4 | 2026-02-12 | SpotAuditor 5.3.2 contains a local buffer overflow vulnerability in the Base64 Encrypted Password tool that allows attackers to execute arbitrary code by craft… |
CVE-2019-25335 | High | 7.5 | 2026-02-12 | PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass… |
CVE-2019-25334 | Medium | 6.2 | 2026-02-12 | Product Key Explorer 4.2.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by overflowing the registration na… |
CVE-2019-25333 | High | 7.5 | 2026-02-12 | Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTT… |
CVE-2019-25332 | High | 8.4 | 2026-02-12 | FTP Commander Pro 8.03 contains a local stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting the EIP register through a… |
CVE-2019-25331 | High | 8.4 | 2026-02-12 | AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulating the 'Exit folder'… |
CVE-2019-25330 | High | 7.5 | 2026-02-12 | SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manip… |
CVE-2019-25329 | High | 7.5 | 2026-02-12 | FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Exception Handler (SEH)… |
CVE-2019-25328 | High | 7.5 | 2026-02-12 | XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can ge… |
CVE-2019-25327 | Critical | 9.8 | 2026-02-12 | Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attack… |
CVE-2019-25325 | High | 8.2 | 2026-02-12 | Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by… |
CVE-2019-25324 | Medium | 6.1 | 2026-02-12 | RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML co… |
CVE-2019-25323 | Medium | 6.1 | 2026-02-12 | Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the… |
CVE-2019-25322 | High | 7.5 | 2026-02-12 | Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can a… |
CVE-2019-25321 | Critical | 9.8 | 2026-02-12 | FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) re… |
CVE-2019-25320 | Medium | 6.5 | 2026-02-12 | E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating l… |
CVE-2019-25319 | Critical | 9.8 | 2026-02-12 | Domain Quester Pro 6.02 contains a stack overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Hand… |
CVE-2019-25318 | High | 8.8 | 2026-02-12 | AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text in… |
CVE-2019-25347 | High | 7.5 | 2026-02-12 | thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can i… |
CVE-2019-25346 | High | 7.5 | 2026-02-12 | TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can… |
CVE-2019-25345 | High | 7.8 | 2026-02-12 | Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Atta… |
CVE-2019-25344 | High | 7.8 | 2026-02-12 | Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory… |
CVE-2019-25343 | High | 7.8 | 2026-02-12 | NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights. Attackers can repl… |
CVE-2019-25313 | Medium | 4.0 | 2026-02-11 | FlexNet Publisher 11.12.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authenticati… |
CVE-2019-25317 | Medium | 6.4 | 2026-02-11 | Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can i… |
CVE-2019-25316 | Medium | 6.4 | 2026-02-11 | GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title… |
CVE-2019-25315 | Medium | 6.4 | 2026-02-11 | WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered l… |
CVE-2019-25314 | Medium | 5.5 | 2026-02-11 | Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malici… |
CVE-2019-25312 | Medium | 5.4 | 2026-02-11 | InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts… |
CVE-2019-25311 | Medium | 6.4 | 2026-02-11 | thesystem version 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple server data i… |
CVE-2019-25310 | High | 7.8 | 2026-02-11 | ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially e… |
CVE-2019-25309 | High | 7.8 | 2026-02-11 | Zilab Remote Console Server 3.2.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevat… |
CVE-2019-25308 | High | 7.8 | 2026-02-11 | Mikogo 5.2.2.150317 contains an unquoted service path vulnerability in the Mikogo-Service Windows service configuration. Attackers can exploit the unquoted pat… |
CVE-2019-25307 | High | 7.8 | 2026-02-11 | WorkgroupMail 7.5.1 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arb… |
CVE-2019-25306 | High | 7.8 | 2026-02-11 | BlackMoon FTP Server 3.1.2.1731 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privil… |
CVE-2019-25305 | High | 7.8 | 2026-02-06 | JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges. Attackers can exploit the unquot… |
CVE-2019-25304 | High | 7.8 | 2026-02-06 | SecurOS Enterprise 10.2 contains an unquoted service path vulnerability in the SecurosCtrlService that allows local users to potentially execute code with elev… |
CVE-2019-25303 | High | 7.1 | 2026-02-06 | TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET paramete… |
CVE-2019-25302 | High | 7.8 | 2026-02-06 | Acer Launch Manager 6.1.7600.16385 contains an unquoted service path vulnerability in the DsiWMIService that allows local users to potentially execute code wit… |
CVE-2019-25301 | Medium | 6.4 | 2026-02-06 | Millhouse-Project 1.414 contains a persistent cross-site scripting vulnerability in the comment submission functionality that allows attackers to inject malici… |
CVE-2019-25300 | High | 7.1 | 2026-02-06 | thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers… |
CVE-2019-25299 | High | 7.1 | 2026-02-06 | RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate database queries through c… |
CVE-2019-25298 | Critical | 9.1 | 2026-02-06 | html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through Router_ID and Router_IP parameters… |
CVE-2019-25294 | Medium | 6.1 | 2026-02-06 | html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through the 'Remark' parameter in ad… |
CVE-2019-25293 | High | 7.8 | 2026-02-06 | BlueStacks App Player 2.4.44.62.57 contains an unquoted service path vulnerability in the BstHdLogRotatorSvc service that allows local attackers to potentially… |
CVE-2019-25292 | High | 7.8 | 2026-02-06 | Alps HID Monitor Service 8.1.0.10 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevat… |
CVE-2019-25266 | High | 7.8 | 2026-02-06 | Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrar… |
CVE-2019-25288 | High | 7.8 | 2026-02-05 | Wacom WTabletService 6.6.7-3 contains an unquoted service path vulnerability that allows local attackers to execute malicious code with elevated privileges. At… |
CVE-2019-25287 | High | 7.8 | 2026-02-05 | Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService that allows local users to potentially ex… |
CVE-2019-25286 | High | 7.8 | 2026-02-05 | GCafé 3.0 contains an unquoted service path vulnerability in the gbClientService that allows local attackers to potentially execute arbitrary code with elevate… |
CVE-2019-25285 | High | 7.8 | 2026-02-05 | Alps Pointing-device Controller 8.1202.1711.04 contains an unquoted service path vulnerability in the ApHidMonitorService that allows local attackers to execut… |
CVE-2019-25283 | High | 7.8 | 2026-02-05 | Shrew Soft VPN Client 2.2.2 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges… |
CVE-2019-25281 | High | 7.8 | 2026-02-05 | NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitra… |
CVE-2019-25276 | High | 7.8 | 2026-02-05 | Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the FactoryTalk Activation Service that allows local users to potentiall… |
CVE-2019-25275 | High | 7.8 | 2026-02-05 | BartVPN 1.2.2 contains an unquoted service path vulnerability in the BartVPNService that allows local attackers to potentially execute arbitrary code with elev… |
CVE-2019-25274 | High | 7.8 | 2026-02-05 | ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrar… |
CVE-2019-25273 | High | 7.8 | 2026-02-05 | Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attackers to potentially execute arbitrary c… |
CVE-2019-25272 | High | 7.8 | 2026-02-05 | TexasSoft CyberPlanet 6.4.131 contains an unquoted service path vulnerability in the CCSrvProxy service that allows local attackers to execute arbitrary code… |
CVE-2019-25271 | High | 7.8 | 2026-02-05 | NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquot… |
CVE-2019-25269 | High | 7.8 | 2026-02-05 | Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inje… |
CVE-2019-25267 | High | 7.8 | 2026-02-05 | Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system pr… |
CVE-2019-25260 | High | 8.2 | 2026-02-03 | OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database con… |
CVE-2019-25265 | Medium | 6.4 | 2026-02-03 | Online Inventory Manager 3.2 contains a stored cross-site scripting vulnerability in the group description field of the admin edit groups section. Attackers ca… |
CVE-2019-25264 | Medium | 6.4 | 2026-02-03 | Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. At… |
CVE-2019-25263 | Medium | 6.4 | 2026-02-03 | Zendesk SweetHawk Survey 1.6 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through support ticket… |
CVE-2019-25261 | High | 7.8 | 2026-02-03 | AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious… |
CVE-2019-25232 | Critical | 9.8 | 2026-01-30 | NetPCLinker 1.0.0.0 contains a buffer overflow vulnerability in the Clients Control Panel DNS/IP field that allows attackers to execute arbitrary shellcode. At… |
CVE-2019-25297 | | 2026-01-16 | Poll, Survey & Quiz Maker Plugin by Opinion Stage Wordpress plugin versions prior to 19.6.25 contain a stored cross-site scripting (XSS) vulnerability via mult… | |
CVE-2019-25296 | Critical | 9.8 | 2026-01-08 | The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and… |
CVE-2019-25295 | Medium | 6.5 | 2026-01-08 | The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows… |
CVE-2019-25291 | High | 7.5 | 2026-01-08 | INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device o… |
CVE-2019-25290 | Medium | 5.3 | 2026-01-08 | Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' paramete… |
CVE-2019-25289 | High | 8.8 | 2026-01-08 | SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'te… |
CVE-2019-25284 | Medium | 6.1 | 2026-01-08 | V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parame… |
CVE-2019-25282 | Critical | 9.8 | 2026-01-08 | V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipulate the 'parent' GET parameter. Attack… |
CVE-2019-25280 | Medium | 6.1 | 2026-01-08 | Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML code through the 'speed' GET parameter. A… |
CVE-2019-25279 | High | 7.5 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the devic… |
CVE-2019-25278 | Medium | 5.9 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. At… |
CVE-2019-25277 | Medium | 6.1 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to injec… |