CVE-2019-8349

MEDIUM 6.1CVE-2019-8349 · Published 08/05/2019 · updated 17/06/2026

In short

CVE-2019-8349 is a MEDIUM (CVSS 6.1) vulnerability affecting htmly (htmly).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
htmly htmly	`= 2.7.4`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) destination parameter to delete feature; the (2) destination parameter to edit feature; (3) content parameter in the profile feature.

References

packetstormsecurity.com/files/151733/HTMLy-2.7.4-Cross-Site-Scripting.html · Exploit
seclists.org/fulldisclosure/2019/Feb/40 · Exploit
netsparker.com/web-applications-advisories · Third Party Advisory

More vulnerabilities in htmly

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

htmly

= 2.7.4

No fix yet

More vulnerabilities in htmly

See all →