CVE-2019-15766

The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_text parameter set to the content of the file to be created). This can be a PHP file that is written to in the public web directory and subsequently executed. The attacker must have network connectivity to the PHP server that is running on the Android device.

• CWE-434

• https://play.google.com/store/apps/details?id=ru.kslabs.ksweb&gl=GBProduct
• https://rastating.github.io/ksweb-android-remote-code-execution/Exploit, Third Party Advisory
• https://play.google.com/store/apps/details?id=ru.kslabs.ksweb&gl=GBProduct
• https://rastating.github.io/ksweb-android-remote-code-execution/Exploit, Third Party Advisory

Published

Oct 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15752Docker Desktop Community Edition before 2.1.0.1 allows local…7.8
• CVE-2019-15753In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard…
• CVE-2019-15757libMirage 3.2.2 in CDemu has a NULL pointer dereference in t…
• CVE-2019-15758An issue was discovered in Binaryen 1.38.32. Missing validat…6.5
• CVE-2019-15759An issue was discovered in Binaryen 1.38.32. Two visitors in…6.5
• CVE-2019-1576Command injection in PAN-0S 9.0.2 and earlier may allow an a…8.8
• CVE-2019-15767In GNU Chess 6.2.5, there is a stack-based buffer overflow i…
• CVE-2019-15769The handl-utm-grabber plugin before 2.6.5 for WordPress has …
• CVE-2019-1577Code injection vulnerability in Palo Alto Networks Traps 5.0…
• CVE-2019-15770The woo-address-book plugin before 1.6.0 for WordPress has s…
• CVE-2019-15771The nd-shortcodes plugin before 6.0 for WordPress has a nopr…
• CVE-2019-15772The nd-donations plugin before 1.4 for WordPress has a nopri…