CVE-2019-11504

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Zotonic before version 0.47 has mod_admin XSS.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel_0.47.0.htmlRelease Notes, Vendor Advisory
http://packetstormsecurity.com/files/152717/Zotonic-0.46-mod_admin-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46788/Exploit, Third Party Advisory, VDB Entry
http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel_0.47.0.htmlRelease Notes, Vendor Advisory
http://packetstormsecurity.com/files/152717/Zotonic-0.46-mod_admin-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46788/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115058.8In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of cod CVE-2019-115068.8In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of CVE-2019-115076.1In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launc CVE-2019-115087.2In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticate CVE-2019-115098.8In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy CVE-2019-11518.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-1151010.0In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attack CVE-2019-115116.1Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.CVE-2019-115129.8Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.CVE-2019-115134.8The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.CVE-2019-115147.5User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.CVE-2019-115154.9core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.