CVE-2019-7655

Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of the login form. This issue was resolved in Wowza Streaming Engine 4.8.5.

• CWE-79

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7655-XSS-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7655.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory
• https://www.wowza.com/pricing/installerVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7655-XSS-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7655.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory
• https://www.wowza.com/pricing/installerVendor Advisory

Published

Jan 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7648controller/fetchpwd.php and controller/doAction.php in Hotel…
• CVE-2019-7649global.encryptPassword in bootstrap/global.js in CMSWing 1.3…
• CVE-2019-7651EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 al…
• CVE-2019-7652TheHive Project UnshortenLink analyzer before 1.1, included …
• CVE-2019-7653The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.…9.8
• CVE-2019-7654Wowza Streaming Engine 4.8.0 and earlier suffers from multip…6.5
• CVE-2019-7656A privilege escalation vulnerability in Wowza Streaming Engi…7.8
• CVE-2019-7659Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers…
• CVE-2019-7660An issue was discovered in PHPMyWind 5.5. The username param…
• CVE-2019-7661An issue was discovered in PHPMyWind 5.5. The method paramet…
• CVE-2019-7662An assertion failure was discovered in wasm::WasmBinaryBuild…6.5
• CVE-2019-7663An Invalid Address dereference was discovered in TIFFWriteDi…