CVE-2019-15855

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted POST request if the default installation procedure was followed. This results in a permanent Denial of Service.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.maarch.org/maarch/maarchRM/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory
https://labs.maarch.org/maarch/maarchRM/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory

Timeline

Published: Jan 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158588.8admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, CVE-2019-158599.8Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi CVE-2019-15864.6A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with ph CVE-2019-158605.5Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.CVE-2019-158627.5An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any exten CVE-2019-158637.5The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-158646.1The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-158658.8The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-158668.8The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im CVE-2019-158678.8The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca CVE-2019-158688.8The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-158695.4The JobCareer theme before 2.5.1 for WordPress has stored XSS.