CVE-2019-11517

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker could add/delete any vhosts without the consent of the owner.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115187.2An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protec CVE-2019-115194.9Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Ed CVE-2019-11528.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-115218.1OX App Suite 7.10.1 allows Content Spoofing.CVE-2019-115225.4OX App Suite 7.10.0 to 7.10.2 allows XSS.CVE-2019-115239.8Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers c CVE-2019-115269.8An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injectio CVE-2019-115278.8An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url paramet CVE-2019-115287.5An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable.CVE-2019-11535.5An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attack CVE-2019-115336.1Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.CVE-2019-115359.8Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote comm