CVE-2019-11511

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-115129.8Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.CVE-2019-115134.8The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.CVE-2019-115147.5User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.CVE-2019-115154.9core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files.CVE-2019-115168.1An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry RespoCVE-2019-115176.5WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incompletCVE-2019-115187.2An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protecCVE-2019-115194.9Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> EdCVE-2019-11528.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-115218.1OX App Suite 7.10.1 allows Content Spoofing.CVE-2019-115225.4OX App Suite 7.10.0 to 7.10.2 allows XSS.CVE-2019-115239.8Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers c
CVE-2019-11511: Medium severity, CVSS 6.1 | Vulnix