CVE-2019-11446

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-114478.8An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile arCVE-2019-114489.8An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTECVE-2019-114496.1I, Librarian 4.10 has XSS via the notes.php notes parameter.CVE-2019-11458.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114509.8whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.CVE-2019-114517.2whatsns 4.0 allows index.php?inform/add.html qid SQL injection.CVE-2019-114527.2whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.CVE-2019-114546.1Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introdCVE-2019-114558.1A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contCVE-2019-114568.8Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.CVE-2019-114578.8Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-passCVE-2019-114587.5An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary fi
CVE-2019-11446: High severity, CVSS 8.8 | Vulnix