CVE-2019-19908

MEDIUM 6.1CVE-2019-19908 · Published 20/12/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
phpmychat-plus ciprianmp	`= 1.98`	No fix yet

Description

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.

References

ciprianmp.com · Vendor Advisory
cinzinga.github.io/CVE-2019-19908 · Third Party Advisory
sourceforge.net/projects/phpmychat · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free