CVE-2019-11198

Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.

• CWE-79

• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20NotesRelease Notes, Vendor Advisory
• https://outpost24.com/blogThird Party Advisory
• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20NotesRelease Notes, Vendor Advisory
• https://outpost24.com/blogThird Party Advisory

Published

Aug 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11189Authentication Bypass by Spoofing in org.onosproject.acl (ac…7.5
• CVE-2019-1119A remote code execution vulnerability exists in the way that…
• CVE-2019-11190The Linux kernel before 4.8 allows local users to bypass ASL…
• CVE-2019-11191The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is ena…
• CVE-2019-11193The FileManager in InfinitumIT DirectAdmin through v1.561 ha…6.1
• CVE-2019-11196An authentication bypass vulnerability in all versions of Va…
• CVE-2019-11199Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within upl…
• CVE-2019-1120A remote code execution vulnerability exists in the way that…
• CVE-2019-11200Dolibarr ERP/CRM 9.0.1 provides a web-based functionality th…
• CVE-2019-11201Dolibarr ERP/CRM 9.0.1 provides a module named website that …
• CVE-2019-11202An issue was discovered that affects the following versions …
• CVE-2019-11203The workspace client, openspace client, app development clie…6.1