CVE-2019-19502

CRÍTICO 9.8CVE-2019-19502 · Published 02/12/2019 · updated 17/06/2026

En resumen

CVE-2019-19502 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a image uploader and browser for ckeditor (maleck).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 80.0% de las vulnerabilidades.
Solución: actualizar a 4.1.9 o posterior.

Package	Affected versions	Patched versions
image uploader and browser for ckeditor maleck	`< 4.1.9`	`4.1.9`

Description

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

References

xsmo/Image-Uploader-and-Browser-for-CKEditor commit c293d38 · Patch
xsmo/Image-Uploader-and-Browser-for-CKEditor · Third Party Advisory
xsmo/Image-Uploader-and-Browser-for-CKEditor#11 · Third Party Advisory
xsmo/Image-Uploader-and-Browser-for-CKEditor#11 · Patch
visat.me/security/cve-2019-19502

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free