CVE-2019-14478

AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload.

• CWE-79

• https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txtExploit, Third Party Advisory
• https://www.adremsoft.com/support/Vendor Advisory
• https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txtExploit, Third Party Advisory
• https://www.adremsoft.com/support/Vendor Advisory

Published

Dec 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14472Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PA…
• CVE-2019-14473eQ-3 Homematic CCU2 and CCU3 use session IDs for authenticat…
• CVE-2019-14474eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Val…
• CVE-2019-14475eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and p…
• CVE-2019-14476AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forger…6.5
• CVE-2019-14477AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage …5.5
• CVE-2019-14479AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In…8.8
• CVE-2019-1448A remote code execution vulnerability exists in Microsoft Ex…7.8
• CVE-2019-14480AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling…9.8
• CVE-2019-14481AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery…5.4
• CVE-2019-14482AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key …9.8
• CVE-2019-14483AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. E…8.8