CVE-2019-12460

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Web Port 1.19.1 allows XSS via the /access/setup type parameter.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/158174/WebPort-1.19.1-Cross-Site-Scripting.html
https://emreovunc.com/blog/en/WebPort-Reflected-XSS-01.pngExploit, Third Party Advisory
https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/158174/WebPort-1.19.1-Cross-Site-Scripting.html
https://emreovunc.com/blog/en/WebPort-Reflected-XSS-01.pngExploit, Third Party Advisory
https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS/Exploit, Third Party Advisory

Timeline

Published: May 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124616.1Web Port 1.19.1 allows XSS via the /log type parameter.CVE-2019-124638.8An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/CVE-2019-124647.5An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a CVE-2019-124658.1An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is CVE-2019-124668.8Wikimedia MediaWiki through 1.32.1 allows CSRF.CVE-2019-124675.3MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate li CVE-2019-124689.8An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail wo CVE-2019-124696.5MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, CVE-2019-12477.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-124706.5Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, CVE-2019-124716.1Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, CVE-2019-124727.5An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP