CVE-2019-13965

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 14, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-139666.1In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This isCVE-2019-139677.5iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile opeCVE-2019-139698.8Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1CVE-2019-13978.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2019-139706.1In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/databaseCVE-2019-139716.1OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.CVE-2019-139726.1LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.CVE-2019-139739.8LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be usedCVE-2019-139748.8LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.CVE-2019-139756.1eGain Chat 15.0.3 allows HTML Injection.CVE-2019-139769.8eGain Chat 15.0.3 allows unrestricted file upload.CVE-2019-139775.4index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4,