CVE-2019-19738

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, which would allow an attacker to input HTML or execute scripts on the site, aka XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197397.5MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext chann CVE-2019-19749.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Ci CVE-2019-197409.8Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.CVE-2019-197417.8Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different i CVE-2019-197424.8On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.CVE-2019-197436.5On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.CVE-2019-197458.8Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and e CVE-2019-197465.5make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large CVE-2019-197479.8NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker wi CVE-2019-197486.1The Work Time Calendar app before 4.7.1 for Jira allows XSS.CVE-2019-19756.1A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-fr CVE-2019-197509.8minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.