What’s Vulnerable › Vulnerabilities

CVE-2019-19735

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-30 · updated 2026-06-17
• Weakness: CWE-916

Description

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.

Affected products

• Mfscripts Yetishare: from 3.5.2 through 4.5.3

References

• https://github.com/jra89/CVE-2019-19735
• https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459
• https://github.com/jra89/CVE-2019-19735
• https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459

Get alerted when CVE-2019-19735 or the next vulnerability affects your stack