CVE-2019-13970

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/AntSwordProject/antSword/commit/4b932e81447b4b0475f4fce45525547395c249d3Patch, Third Party Advisory
https://github.com/AntSwordProject/antSword/compare/ed01dea...834063aThird Party Advisory
https://github.com/AntSwordProject/antSword/issues/151Exploit, Third Party Advisory
https://github.com/AntSwordProject/antSword/commit/4b932e81447b4b0475f4fce45525547395c249d3Patch, Third Party Advisory
https://github.com/AntSwordProject/antSword/compare/ed01dea...834063aThird Party Advisory
https://github.com/AntSwordProject/antSword/issues/151Exploit, Third Party Advisory

Timeline

Published: Jul 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-139716.1OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.CVE-2019-139726.1LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.CVE-2019-139739.8LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used CVE-2019-139748.8LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.CVE-2019-139756.1eGain Chat 15.0.3 allows HTML Injection.CVE-2019-139769.8eGain Chat 15.0.3 allows unrestricted file upload.CVE-2019-139775.4index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, CVE-2019-139788.8Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.CVE-2019-139798.8In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.CVE-2019-13988.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us CVE-2019-139808.8In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals CVE-2019-139815.3In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ di