CVE-2019-6018

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
The NetCommons Project	NetCommons	3.2.2 and earlier (NetCommons3.x)

References

http://jvn.jp/en/jp/JVN74530672/index.htmlThird Party Advisory
https://www.netcommons.org/blogs/blog_entries/view/6/7b40ca16fc8358a57d0e178c931c0027?frame_id=13Vendor Advisory
http://jvn.jp/en/jp/JVN74530672/index.htmlThird Party Advisory
https://www.netcommons.org/blogs/blog_entries/view/6/7b40ca16fc8358a57d0e178c931c0027?frame_id=13Vendor Advisory

Timeline

Published: Dec 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-60197.8Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL i CVE-2019-60206.1Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.CVE-2019-60216.1Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbit CVE-2019-60226.5Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'CVE-2019-60234.3Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction which may result in obtaining data without CVE-2019-60246.5Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and ob CVE-2019-60256.1Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 CVE-2019-60267.8Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScope CVE-2019-60278.8Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of CVE-2019-60296.1Cross-site scripting vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via CVE-2019-60308.8Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication CVE-2019-60316.1Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attack