CVE-2019-17606

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jaredly/hexo-admin/commits/masterPatch, Third Party Advisory
https://mega.nz/#%218MYnUQzC%21ZCqixrGyHdBhimCmrszSXdFmI2feImhuZZMcnplNBQQ
https://www.npmjs.com/advisoriesThird Party Advisory
https://www.npmjs.com/advisories/1211Third Party Advisory
https://github.com/jaredly/hexo-admin/commits/masterPatch, Third Party Advisory
https://mega.nz/#%218MYnUQzC%21ZCqixrGyHdBhimCmrszSXdFmI2feImhuZZMcnplNBQQ
https://www.npmjs.com/advisoriesThird Party Advisory
https://www.npmjs.com/advisories/1211Third Party Advisory

Timeline

Published: Oct 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-176076.1HongCMS 3.0.0 has XSS via the install/index.php servername parameter.CVE-2019-176086.1HongCMS 3.0.0 has XSS via the install/index.php dbname parameter.CVE-2019-176096.1HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter.CVE-2019-17614.3A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacen CVE-2019-176106.1HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter.CVE-2019-176116.1HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.CVE-2019-176127.2An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.c CVE-2019-176139.8qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature t CVE-2019-17624.4A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensit CVE-2019-176219.8The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec CVE-2019-176247.8"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 tim CVE-2019-176259.0There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The prob