CVE-2019-8278

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Kaspersky LabInvision Power Board3.3.1 - 3.4.8

References

Timeline

Published
Mar 2, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-82795.4Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.CVE-2019-82809.8UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution.CVE-2019-82825.3Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language paCVE-2019-82836.5Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript tCVE-2019-82858.8Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary coCVE-2019-82864.3Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially CVE-2019-82879.8TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. CVE-2019-82885.4Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.CVE-2019-82895.4Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variableCVE-2019-82906.1Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to seCVE-2019-82917.5Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.CVE-2019-82925.3Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary pr
CVE-2019-8278: Medium severity, CVSS 6.1 | Vulnix