CVE-2019-11559

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-17 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.

Affected products

Hrworks: 1.16.1

References

http://seclists.org/fulldisclosure/2019/Sep/28
https://twitter.com/gpheheise/status/1173896069769519105?s=21
http://seclists.org/fulldisclosure/2019/Sep/28
https://twitter.com/gpheheise/status/1173896069769519105?s=21

Get alerted when CVE-2019-11559 or the next vulnerability affects your stack