What’s Vulnerable › Vulnerabilities

CVE-2019-18209

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-19 · updated 2026-06-17
• Weakness: CWE-79

Description

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.

Affected products

• etherpad-lite: 1.7.5

References

• https://github.com/ether/etherpad-lite/commit/5879037ddca4ab9a4002adf90fc7ce6c9f82f01b
• https://github.com/ether/etherpad-lite/commit/5879037ddca4ab9a4002adf90fc7ce6c9f82f01b

Get alerted when CVE-2019-18209 or the next vulnerability affects your stack