CVE-2019-17604

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information (first name, last name, email, CV, phone number, and all other personal information) by changing the value of the candidate id (the id parameter).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.eyecomms.com/Products/eyeCMS.htmlProduct, Vendor Advisory
https://gist.github.com/AhMyth/b0f7e4b8244def8eb8d7d8c61fa6d4e5Exploit, Third Party Advisory
http://www.eyecomms.com/Products/eyeCMS.htmlProduct, Vendor Advisory
https://gist.github.com/AhMyth/b0f7e4b8244def8eb8d7d8c61fa6d4e5Exploit, Third Party Advisory

Timeline

Published: Nov 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-176058.8A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also CVE-2019-176066.1The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of CVE-2019-176076.1HongCMS 3.0.0 has XSS via the install/index.php servername parameter.CVE-2019-176086.1HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.CVE-2019-176096.1HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.CVE-2019-17614.3A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacen CVE-2019-176106.1HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.CVE-2019-176116.1HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.CVE-2019-176127.2An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.c CVE-2019-176139.8qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature t CVE-2019-17624.4A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensit CVE-2019-176219.8The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec