CVE-2019-15072

The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.

• CWE-79
• CWE-79

• https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24aThird Party Advisory
• https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201909002Third Party Advisory
• https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txtThird Party Advisory
• https://www.openfind.com.tw/taiwan/resource.htmlProduct, Vendor Advisory
• https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.htmlThird Party Advisory
• https://gist.github.com/chtsecurity/b3396500d4686ad47fb26f64967ef24aThird Party Advisory
• https://gist.github.com/tonykuo76/5bf1ac369d953d5276afe0a2d04c2147Third Party Advisory
• https://tvn.twcert.org.tw/taiwanvn/TVN-201909002Third Party Advisory
• https://www.chtsecurity.com/download/0837ce00c27c73dd3ba3a0d4a7df3a41aaea1ac1e9831a5d61bb64ed484a3598.txtThird Party Advisory
• https://www.openfind.com.tw/taiwan/resource.htmlProduct, Vendor Advisory
• https://www.twcert.org.tw/en/cp-128-3086-ff35d-2.htmlThird Party Advisory

Published

Nov 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15066An “invalid command” handler issue was discovered in HiNet G…9.8
• CVE-2019-15067An authentication bypass vulnerability discovered in Smart B…9.8
• CVE-2019-15068A broken access control vulnerability in Smart Battery A4, a…9.8
• CVE-2019-15069An unsafe authentication interface was discovered in Smart B…9.8
• CVE-2019-1507Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15071The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7…6.1
• CVE-2019-15073An Open Redirect vulnerability for all browsers in MAIL2000 …6.1
• CVE-2019-15074The Timeline feature in my_view_page.php in MantisBT through…
• CVE-2019-15075An issue was discovered in iNextrix ASTPP before 4.0.1. web_…7.5
• CVE-2019-15078An issue was discovered in a smart contract implementation f…7.5
• CVE-2019-15079A typo exists in the constructor of a smart contract impleme…7.5
• CVE-2019-1508Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…