CVE-2019-19908

moderate-risk
Published 2019-12-20

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.

Do I need to act?

!
44.7% chance of exploitation in next 30 days
EPSS score — higher than 55% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Ciprianmp

References (6)

Vendor Advisory http://ciprianmp.com/
Third Party Advisory https://cinzinga.github.io/CVE-2019-19908/
Third Party Advisory https://sourceforge.net/projects/phpmychat/
Vendor Advisory http://ciprianmp.com/
Third Party Advisory https://cinzinga.github.io/CVE-2019-19908/
Third Party Advisory https://sourceforge.net/projects/phpmychat/
45
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 17/34 · Moderate
Exposure 5/34 · Minimal