CVE-2019-15071

The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.

• CWE-79
• CWE-79

• https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216dThird Party Advisory
• https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201909001Third Party Advisory
• https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txtThird Party Advisory
• https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
• https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
• https://www.openfind.com.tw/taiwan/resource.htmlProduct, Vendor Advisory
• https://www.twcert.org.tw/en/cp-128-3085-45bda-2.htmlThird Party Advisory
• https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216dThird Party Advisory
• https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201909001Third Party Advisory
• https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txtThird Party Advisory
• https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf
• https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf
• https://www.openfind.com.tw/taiwan/resource.htmlProduct, Vendor Advisory
• https://www.twcert.org.tw/en/cp-128-3085-45bda-2.htmlThird Party Advisory

Published

Nov 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15065A service which is hosted on port 6998 in HiNet GPON firmwar…7.5
• CVE-2019-15066An “invalid command” handler issue was discovered in HiNet G…9.8
• CVE-2019-15067An authentication bypass vulnerability discovered in Smart B…9.8
• CVE-2019-15068A broken access control vulnerability in Smart Battery A4, a…9.8
• CVE-2019-15069An unsafe authentication interface was discovered in Smart B…9.8
• CVE-2019-1507Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15072The login feature in "/cgi-bin/portal" in MAIL2000 through v…6.1
• CVE-2019-15073An Open Redirect vulnerability for all browsers in MAIL2000 …6.1
• CVE-2019-15074The Timeline feature in my_view_page.php in MantisBT through…
• CVE-2019-15075An issue was discovered in iNextrix ASTPP before 4.0.1. web_…7.5
• CVE-2019-15078An issue was discovered in a smart contract implementation f…7.5
• CVE-2019-15079A typo exists in the constructor of a smart contract impleme…7.5