CVE-2019-11193

The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.

• CWE-79
• CWE-352

• http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://numanozdemir.com/respdisc/directadmin.pdfBroken Link, Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46694Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://numanozdemir.com/respdisc/directadmin.pdfBroken Link, Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46694Exploit, Third Party Advisory, VDB Entry

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11185The WP Live Chat Support Pro plugin through 8.0.26 for WordP…
• CVE-2019-11187Incorrect Access Control in the LDAP class of GONICUS GOsa t…
• CVE-2019-11189Authentication Bypass by Spoofing in org.onosproject.acl (ac…7.5
• CVE-2019-1119A remote code execution vulnerability exists in the way that…
• CVE-2019-11190The Linux kernel before 4.8 allows local users to bypass ASL…
• CVE-2019-11191The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is ena…
• CVE-2019-11196An authentication bypass vulnerability in all versions of Va…
• CVE-2019-11198Multiple cross-site scripting (XSS) vulnerabilities in Sitec…
• CVE-2019-11199Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within upl…
• CVE-2019-1120A remote code execution vulnerability exists in the way that…
• CVE-2019-11200Dolibarr ERP/CRM 9.0.1 provides a web-based functionality th…
• CVE-2019-11201Dolibarr ERP/CRM 9.0.1 provides a module named website that …