CVE-2019-19392

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.joaoorvalho.com/description-cve-2019-19392/Exploit, Third Party Advisory
https://github.com/fordnn/usersexportimport/commits/masterThird Party Advisory
https://blog.joaoorvalho.com/description-cve-2019-19392/Exploit, Third Party Advisory
https://github.com/fordnn/usersexportimport/commits/masterThird Party Advisory

Timeline

Published: Jan 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193936.1The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configur CVE-2019-193946.1Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.CVE-2019-193967.5illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg CVE-2019-193977.5There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit CVE-2019-193989.8M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. Due to the input validation logic is incorre CVE-2019-19405.9A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticate CVE-2019-19416.1A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2019-194113.7USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 ha CVE-2019-194124.6Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the fact CVE-2019-194137.5There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker c CVE-2019-194147.5There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker c CVE-2019-194157.5The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabili