CVE-2019-13076

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-130776.1Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) th CVE-2019-130788.8Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execu CVE-2019-130798.8Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execu CVE-2019-13087.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C CVE-2019-130805.4Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authe CVE-2019-130815.4Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated CVE-2019-130829.8Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP arch CVE-2019-130837.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a.CVE-2019-130847.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739.CVE-2019-130857.8XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa.CVE-2019-130869.8core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and CVE-2019-13096.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv