CVE-2019-5963

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Zoho SalesIQ Team	Zoho SalesIQ	1.0.8 and earlier

References

https://jvn.jp/en/jp/JVN88962935/index.htmlThird Party Advisory
https://wordpress.org/plugins/zoho-salesiq/Product, Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9433Third Party Advisory
https://jvn.jp/en/jp/JVN88962935/index.htmlThird Party Advisory
https://wordpress.org/plugins/zoho-salesiq/Product, Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9433Third Party Advisory

Timeline

Published: Jul 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-59648.8iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console a CVE-2019-59656.1Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct ph CVE-2019-59665.4Joruri Mail 2.1.4 and earlier does not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and alter/di CVE-2019-59676.1Cross-site scripting vulnerability in Joruri CMS 2017 Release2 and earlier allows remote attackers to inject arbitrary web script or HTML vi CVE-2019-59688.8Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administ CVE-2019-59696.1Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing CVE-2019-59706.1Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML vi CVE-2019-59718.8Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication CVE-2019-59726.1Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML CVE-2019-59738.8Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authenticat CVE-2019-59748.8Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentica CVE-2019-59755.4DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web