CVE-2019-13186

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.

• CWE-79

• https://github.com/bg5sbk/MiniCMS/issues/31Exploit, Third Party Advisory
• https://github.com/bg5sbk/MiniCMS/issues/31Exploit, Third Party Advisory

Published

Jul 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13178modules/luksbootkeyfile/main.py in Calamares versions 3.1 th…
• CVE-2019-13179Calamares versions 3.1 through 3.2.10 copies a LUKS encrypti…
• CVE-2019-1318A spoofing vulnerability exists when Transport Layer Securit…5.9
• CVE-2019-13181A CSV injection vulnerability exists in the web UI of SolarW…6.5
• CVE-2019-13182A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2019-13183Flarum before 0.1.0-beta.9 allows CSRF against all POST endp…
• CVE-2019-13187The Rich Text Formatter (Redactor) extension through v1.1.1 …
• CVE-2019-13188In Knowage through 6.1.1, an unauthenticated user can bypass…
• CVE-2019-13189In Knowage through 6.1.1, there is XSS via the start_url or …
• CVE-2019-1319An elevation of privilege vulnerability exists in Windows Er…7.8
• CVE-2019-13190In Knowage through 6.1.1, the sign up page does not invalida…
• CVE-2019-13191A SQL injection vulnerability in IntraMaps MapControl 8 allo…