CVE-2019-5722

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Due to a lack of user input validation in parameter handling, it has various SQL injections, including on the login form, and on the search form for a key ring number.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/151117/PORTIER-4.4.4.2-4.4.4.6-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Jan/7Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/46163/Exploit, Third Party Advisory, VDB Entry
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-012.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/151117/PORTIER-4.4.4.2-4.4.4.6-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/Jan/7Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/46163/Exploit, Third Party Advisory, VDB Entry
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-012.txtExploit, Third Party Advisory

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-57239.8An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather than as a hash value,CVE-2019-57257.5qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a UR CVE-2019-57275.4Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6 CVE-2019-57298.1Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.CVE-2019-57368.6runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequen CVE-2019-57377.5In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of S CVE-2019-57397.5Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduc CVE-2019-57477.5An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or re CVE-2019-57489.8In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.CVE-2019-57546.5Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy s CVE-2019-57558.1Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write v CVE-2019-57568.8Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary