CVE-2019-25337

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by manipulating the share.php endpoint. Attackers can send crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter to retrieve comprehensive user information.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Feb 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2019

CVE-2019-253385.3DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valCVE-2019-253397.5GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the applicationCVE-2019-25347.1Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.CVE-2019-253407.5SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the applicationCVE-2019-253417.5iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manCVE-2019-253427.5Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the databCVE-2019-253437.8NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights.CVE-2019-253447.8Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the appCVE-2019-253457.8Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute aCVE-2019-253467.5TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameCVE-2019-253477.5thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parametCVE-2019-253497.5ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized