CVE-2019-11429

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152696/CentOS-Web-Panel-Domain-Field-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://CentOS-WebPanel.comVendor Advisory
https://www.exploit-db.com/exploits/46784/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/152696/CentOS-Web-Panel-Domain-Field-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://CentOS-WebPanel.comVendor Advisory
https://www.exploit-db.com/exploits/46784/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-11435.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-11448.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114447.2An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands CVE-2019-114457.2OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home d CVE-2019-114468.8An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Uploa CVE-2019-114478.8An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile ar CVE-2019-114489.8An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTE CVE-2019-114496.1I, Librarian 4.10 has XSS via the notes.php notes parameter.CVE-2019-11458.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114509.8whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.CVE-2019-114517.2whatsns 4.0 allows index.php?inform/add.html qid SQL injection.CVE-2019-114527.2whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.