CVE-2019-20518

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-205196.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.CVE-2019-20527.5In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This could lead to remote information disclosure CVE-2019-205206.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.CVE-2019-205216.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.CVE-2019-205226.1ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.CVE-2019-205236.1ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.CVE-2019-205246.1ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.CVE-2019-205256.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.CVE-2019-205266.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.CVE-2019-205276.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.CVE-2019-205286.1Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.CVE-2019-205297.5In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as publi
CVE-2019-20518: Medium severity, CVSS 6.1 | Vulnix