CVE-2019-1577

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-157708.8The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.CVE-2019-157716.1The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157726.1The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157736.1The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157746.1The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157756.1The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157766.1The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a C CVE-2019-157775.4The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-157785.4The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.CVE-2019-157798.8The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.CVE-2019-15786.1Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an CVE-2019-157809.8The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.