VULNERABILITY INTELLIGENCE

CVE-2019-9761

CVSS score7.5 HIGH
EPSS probability1.71%
CISA KEVNot currently listed
Published2019-03-14
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.

Weakness classification

  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references