CVE-2019-19849

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.

• CWE-502

• https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:securityVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2019-026/Vendor Advisory
• https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:securityVendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2019-026/Vendor Advisory

Published

Dec 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19843Incorrect access control in the web interface in Ruckus Wire…9.8
• CVE-2019-19844Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.…9.8
• CVE-2019-19845In Joomla! before 3.9.14, a missing access check in framewor…5.3
• CVE-2019-19846In Joomla! before 3.9.14, the lack of validation of configur…9.8
• CVE-2019-19847Libspiro through 20190731 has a stack-based buffer overflow …8.1
• CVE-2019-19848An issue was discovered in TYPO3 before 8.7.30, 9.x before 9…7.2
• CVE-2019-1985In findAvailSpellCheckerLocked of TextServicesManagerService…
• CVE-2019-19850An issue was discovered in TYPO3 before 8.7.30, 9.x before 9…7.2
• CVE-2019-19851An XSS Injection vulnerability exists in Sangoma FreePBX and…4.8
• CVE-2019-19852An XSS Injection vulnerability exists in Sangoma FreePBX and…4.8
• CVE-2019-19854An issue was discovered in Serpico (aka SimplE RePort wrItin…8.8
• CVE-2019-19855An issue was discovered in Serpico (aka SimplE RePort wrItin…4.8