CVE-2019-19634

CriticalCVSS 9.8/10Last modified Jun 26, 2026

Description

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jra89/CVE-2019-19634Third Party Advisory
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068Exploit, Third Party Advisory
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
https://github.com/jra89/CVE-2019-19634Third Party Advisory
https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068Exploit, Third Party Advisory
https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e

Timeline

Published: Dec 17, 2019
Last modified: Jun 26, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-196359.8An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.CVE-2019-196369.8An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.CVE-2019-196379.8An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.CVE-2019-196389.8An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer ov CVE-2019-19647.5A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpecte CVE-2019-196428.8On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenti CVE-2019-196437.5ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.CVE-2019-196455.5alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction w CVE-2019-196469.8pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.CVE-2019-196477.8radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to CVE-2019-196487.8In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially craf CVE-2019-196499.8Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter