CVE-2019-9834

The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot

• CWE-79

• https://github.com/netdata/netdata/issues/5800#issuecomment-510986112Third Party Advisory
• https://www.exploit-db.com/exploits/46545Exploit, Third Party Advisory, VDB Entry
• https://www.youtube.com/watch?v=zSG93yX0B8kExploit, Third Party Advisory
• https://github.com/netdata/netdata/issues/5800#issuecomment-510986112Third Party Advisory
• https://www.exploit-db.com/exploits/46545Exploit, Third Party Advisory, VDB Entry
• https://www.youtube.com/watch?v=zSG93yX0B8kExploit, Third Party Advisory

Published

Mar 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9826The fulltext search component in phpBB before 3.2.6 allows D…
• CVE-2019-9827Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a …
• CVE-2019-9829Maccms 10 allows remote attackers to execute arbitrary PHP c…
• CVE-2019-9831The AirMore application through 1.6.1 for Android allows rem…
• CVE-2019-9832The AirDrop application through 2.0 for Android allows remot…
• CVE-2019-9833The Screen Stream application through 3.0.15 for Android all…
• CVE-2019-9835The receiver (aka bridge) component of Fujitsu Wireless Keyb…
• CVE-2019-9836Secure Encrypted Virtualization (SEV) on Advanced Micro Devi…5.3
• CVE-2019-9837Doorkeeper::OpenidConnect (aka the OpenID Connect extension …
• CVE-2019-9838VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php …
• CVE-2019-9839VFront 0.99.5 has Reflected XSS via the admin/menu_registri.…
• CVE-2019-9841Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.