CVE-2019-16699

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-16706.1A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote aCVE-2019-167009.8The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For vCVE-2019-167018.8pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shCVE-2019-167029.8Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LogiCVE-2019-167036.1admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.CVE-2019-167044.8admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.CVE-2019-167059.1Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.CVE-2019-167068.8kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.CVE-2019-167076.5Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.CVE-2019-167086.5ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.CVE-2019-167096.5ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.CVE-2019-16716.1A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote atta
CVE-2019-16699: Critical severity, CVSS 9.8 | Vulnix