CVE-2019-7535

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/nenf/2f16cd547c2afe166d1cb3f88f18bf81Third Party Advisory
https://gist.github.com/nenf/2f16cd547c2afe166d1cb3f88f18bf81Third Party Advisory

Timeline

Published: Feb 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-75379.8An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Pyth CVE-2019-75398.8A code injection issue was discovered in ipycache through 2016-05-31.CVE-2019-75416.1Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.CVE-2019-75436.1In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability.CVE-2019-75445.4An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Scripting (XSS) vulnerabili CVE-2019-75455.4In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name fie CVE-2019-75466.1An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) vulnerability.CVE-2019-75474.8An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Pa CVE-2019-75487.8SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.CVE-2019-75494.3An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.5.10, 11.6.x before 11.6.8, and 11.7.x before 11.CVE-2019-75505.3In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/CVE-2019-75519.0Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing acti