VULNERABILITY INTELLIGENCE

CVE-2019-10226

CVSS score5.4 MEDIUM
EPSS probability4.70%
CISA KEVNot currently listed
Published2019-06-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Description

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.

Weakness classification

  • nvd@nist.gov: CWE-79

Primary references