What’s Vulnerable › Vulnerabilities

CVE-2019-19502

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-02 · updated 2026-06-17
• Weakness: CWE-94

Description

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

Affected products

• Maleck Image Uploader And Browser For Ckeditor: before 4.1.9 — fixed in 4.1.9

How to fix

Upgrade to a fixed version: Maleck Image Uploader And Browser For Ckeditor 4.1.9. Check the vendor advisory for mitigations.

References

• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
• https://visat.me/security/cve-2019-19502/
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/commit/c293d38c8b99444e775d94c1af50c9676c6544d2
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/compare/4.1.8...v4.1.9
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11
• https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor/pull/11/commits/5c7a6b0e10504f08e2f50655541b767e276ce749
• https://visat.me/security/cve-2019-19502/

Get alerted when CVE-2019-19502 or the next vulnerability affects your stack