CVE-2019-19392

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Jan 21, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-193936.1The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurCVE-2019-193946.1Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.CVE-2019-193967.5illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsgCVE-2019-193977.5There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploitCVE-2019-193989.8M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. Due to the input validation logic is incorreCVE-2019-19405.9A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticateCVE-2019-19416.1A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeCVE-2019-194113.7USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 haCVE-2019-194124.6Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factCVE-2019-194137.5There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker cCVE-2019-194147.5There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker cCVE-2019-194157.5The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabili
CVE-2019-19392: Critical severity, CVSS 9.8 | Vulnix