CVE-2018-14919

LOYTEC LGATE-902 6.3.2 devices allow XSS.

• CWE-79

• http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/12Exploit, Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Apr/12Exploit, Mailing List, Third Party Advisory
• https://www.mag-securs.com/alertes/artmid/1894/articleid/41651/loytec-lgate-902-up-to-641-alarm-log-obj-handle-cross-site-scripting.aspxThird Party Advisory
• http://packetstormsecurity.com/files/152453/Loytec-LGATE-902-XSS-Traversal-File-Deletion.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/12Exploit, Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2019/Apr/12Exploit, Mailing List, Third Party Advisory
• https://www.mag-securs.com/alertes/artmid/1894/articleid/41651/loytec-lgate-902-up-to-641-alarm-log-obj-handle-cross-site-scripting.aspxThird Party Advisory

Published

Jun 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14911A file upload vulnerability exists in ukcms v1.1.7 and earli…
• CVE-2018-14912cgit_clone_objects in CGit before 1.2.1 has a directory trav…
• CVE-2018-14915Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-14916LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion…
• CVE-2018-14917Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-14918LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.
• CVE-2018-1492IBM Jazz Foundation products could allow a user with physica…4.3
• CVE-2018-14922Multiple cross-site scripting (XSS) vulnerabilities in Monst…
• CVE-2018-14923A vulnerability in uniview EZPlayer 1.0.6 could allow an att…
• CVE-2018-14924Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as …
• CVE-2018-14925Matera Banco 1.0.0 mishandles Java errors in the backend, as…
• CVE-2018-14926Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contin…