CVE-2019-12928

The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue

• CWE-78
• CWE-668

• https://fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928/Exploit, Third Party Advisory
• https://fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928/Exploit, Third Party Advisory

Published

Jun 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12922A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any se…6.5
• CVE-2019-12923In MailEnable Enterprise Premium 10.23, the potential cross-…
• CVE-2019-12924MailEnable Enterprise Premium 10.23 was vulnerable to XML Ex…
• CVE-2019-12925MailEnable Enterprise Premium 10.23 was vulnerable to multip…
• CVE-2019-12926MailEnable Enterprise Premium 10.23 did not use appropriate …
• CVE-2019-12927MailEnable Enterprise Premium 10.23 was vulnerable to stored…
• CVE-2019-12929The QMP guest_exec command in QEMU 4.0.0 and earlier is pron…
• CVE-2019-1293An information disclosure vulnerability exists in Windows wh…5.5
• CVE-2019-12930A cross-site scripting (XSS) vulnerability in noMenu() and n…
• CVE-2019-12932A stored XSS vulnerability was found in SeedDMS 5.1.11 due t…
• CVE-2019-12933Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12934An issue was discovered in the wp-code-highlightjs plugin th…