CVE-2019-5886

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation.

• CWE-667
• CWE-862

• https://github.com/gongfuxiang/shopxo/issues/1Exploit, Third Party Advisory
• https://github.com/gongfuxiang/shopxo/issues/1Exploit, Third Party Advisory

Published

Jan 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5880Insufficient policy enforcement in Blink in Google Chrome pr…7.4
• CVE-2019-5881Out of bounds read in SwiftShader in Google Chrome prior to …8.1
• CVE-2019-5882Irssi 1.1.x before 1.1.2 has a use after free when hidden li…
• CVE-2019-5883An Incorrect Access Control issue was discovered in GitLab C…
• CVE-2019-5884php/elFinder.class.php in elFinder before 2.1.45 leaks infor…5.9
• CVE-2019-5885Matrix Synapse before 0.34.0.1, when the macaroon_secret_key…
• CVE-2019-5887An issue was discovered in ShopXO 1.2.0. In the UnlinkDir me…
• CVE-2019-5888Multiple XSS vulnerabilities were discovered in OverIT Geoca…6.1
• CVE-2019-5889An log-management directory traversal issue was discovered i…7.5
• CVE-2019-5890An issue was discovered in OverIT Geocall 6.3 before build 2…8.8
• CVE-2019-5891An issue was discovered in OverIT Geocall 6.3 before build 2…9.8
• CVE-2019-5892bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x b…