CVE-2019-16185

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-161867.2In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.CVE-2019-161877.5Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-sCVE-2019-161887.1HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. In particular, an attacker can CVE-2019-16199.8A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attCVE-2019-161909.8SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows AuthentCVE-2019-161929.8upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code througCVE-2019-161935.4In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILCVE-2019-161949.8SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makCVE-2019-161956.1Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.CVE-2019-161976.1In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text betweeCVE-2019-161986.5KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.CVE-2019-161999.8eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web i
CVE-2019-16185: High severity, CVSS 7.2 | Vulnix