CVE-2019-20221

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.php page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-202226.1In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.CVE-2019-202236.1In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CV CVE-2019-202248.8netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell CVE-2019-202256.1MyBB before 1.8.22 allows an open redirect on login.CVE-2019-20237.8In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This CVE-2019-20247.8In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to local escalation of privilege with no CVE-2019-20257.8In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privil CVE-2019-20267.8In updateAssistMenuItems of Editor.java, there is a possible escape from the Setup Wizard due to a missing permission check. This could lead CVE-2019-20278.8In floor0_inverse1 of floor0.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code exe CVE-2019-20288.8In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. This could lead to remote code execution with no additiona CVE-2019-20298.8In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution CVE-2019-20309.8In removeInterfaceAddress of NetworkController.cpp, there is a possible use after free. This could lead to remote code execution with no add