CVE-2019-13493

In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.

• CWE-79

• http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/153613/Sitecore-9.0-Rev-171002-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry

Published

Jul 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-13484In Xymon through 4.3.28, a buffer overflow exists in the sta…
• CVE-2019-13485In Xymon through 4.3.28, a stack-based buffer overflow vulne…
• CVE-2019-13486In Xymon through 4.3.28, a stack-based buffer overflow exist…
• CVE-2019-13488A cross-site scripting (XSS) vulnerability in static/js/trap…
• CVE-2019-13489Trape through 2019-05-08 has SQL injection via the data[2] v…
• CVE-2019-1349A remote code execution vulnerability exists when Git for Vi…8.8
• CVE-2019-13494nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x be…
• CVE-2019-13495In firmware version 4.50 of Zyxel XGS2210-52HP, multiple sto…5.4
• CVE-2019-13496One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allo…8.1
• CVE-2019-13497One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allo…6.5
• CVE-2019-13498One Identity Cloud Access Manager 8.1.3 does not use HTTP St…7.4
• CVE-2019-1350A remote code execution vulnerability exists when Git for Vi…8.8