CVE-2019-18839

FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully compromise the system using a POST request. When the admin visits the user information, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

• CWE-78
• CWE-79

• https://github.com/fuzzlove/FUDforum-XSS-RCEExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155261/FUDForum-3.0.9-Code-Execution-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/fuzzlove/FUDforum-XSS-RCEExploit, Third Party Advisory
• https://packetstormsecurity.com/files/155261/FUDForum-3.0.9-Code-Execution-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry

Published

Nov 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18833Barco ClickShare Button R9861500D01 devices before 1.9.0 all…5.9
• CVE-2019-18834Persistent XSS in the WooCommerce Subscriptions plugin befor…6.1
• CVE-2019-18835Matrix Synapse before 1.5.0 mishandles signature checking on…9.8
• CVE-2019-18836Envoy 1.12.0 allows a remote denial of service because of re…7.5
• CVE-2019-18837An issue was discovered in crun before 0.10.5. With a crafte…8.6
• CVE-2019-18838An issue was discovered in Envoy 1.12.0. Upon receipt of a m…7.5
• CVE-2019-1884A vulnerability in the web proxy functionality of Cisco Asyn…7.7
• CVE-2019-18840In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity ch…7.5
• CVE-2019-18841Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick g…7.3
• CVE-2019-18842A cross-site scripting (XSS) vulnerability in the configurat…6.1
• CVE-2019-18844The Device Model in ACRN before 2019w25.5-140000p relies on …7.5
• CVE-2019-18845The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB b…7.1