CVE-2019-15750

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.contextis.com/en/resources/advisories/cve-2019-15750Third Party Advisory
https://www.contextis.com/en/resources/advisories/cve-2019-15750Third Party Advisory

Timeline

Published: Oct 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-157519.8An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM f CVE-2019-157527.8Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex CVE-2019-157539.1In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligat CVE-2019-157576.5libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.CVE-2019-157586.5An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cp CVE-2019-157596.5An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::Lo CVE-2019-15768.8Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentiall CVE-2019-157668.8The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJA CVE-2019-157677.8In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EP CVE-2019-157698.8The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.CVE-2019-15776.3Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScrip CVE-2019-157708.8The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.