CVE-2019-13976

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

eGain Chat 15.0.3 allows unrestricted file upload.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-139775.4index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, CVE-2019-139788.8Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.CVE-2019-139798.8In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.CVE-2019-13988.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usCVE-2019-139808.8In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals CVE-2019-139815.3In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ diCVE-2019-139825.3interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.CVE-2019-139839.8Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.phpCVE-2019-139848.8Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each CVE-2019-139886.5Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).CVE-2019-139897.8dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.CVE-2019-13996.2A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on
CVE-2019-13976: Critical severity, CVSS 9.8 | Vulnix