What’s Vulnerable › Vulnerabilities

CVE-2019-19020

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-02 · updated 2026-06-17
• Weakness: CWE-434

Description

An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.

Affected products

• Titanhq Webtitan: before 5.18 — fixed in 5.18

How to fix

Upgrade to a fixed version: Titanhq Webtitan 5.18. Check the vendor advisory for mitigations.

References

• https://write-up.github.io/webtitan/
• https://www.webtitan.com/resources/product-updates/
• https://write-up.github.io/webtitan/
• https://www.webtitan.com/resources/product-updates/

Get alerted when CVE-2019-19020 or the next vulnerability affects your stack