SunHater KCFinder cross-site scripting (XSS) vulnerability in upload.php

MEDIO 6.1CVE-2019-14315 · GHSA-vwh5-78jc-hpjx · Published 28/07/2019 · updated 17/06/2026

In breve

CVE-2019-14315 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda sunhater/kcfinder, kcfinder (sunhater).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.2%, superiore al 69.3% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
sunhater/kcfinder Packagist	`≤ 3.20-test2`	No fix yet
kcfinder sunhater	`= 3.20≤ 3.12`	No fix yet

Description

A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-14315 · ADVISORY
sunhater/kcfinder · WEB
sunhater/kcfinder#186 · WEB
sunhater/kcfinder · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free