Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-11368. PoCs published by Luca.Chiou.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in AUO Solar Data Recorder by injecting malicious JavaScript into the 'addr' parameter of a POST request to /protect/config.htm. The payload is stored in the database and executed when accessed.
Description
Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.
Exploits (1)
exploitdb
WORKING POC
by Luca.Chiou · textwebappshardware
https://www.exploit-db.com/exploits/46896
This exploit demonstrates a stored XSS vulnerability in AUO Solar Data Recorder by injecting malicious JavaScript into the 'addr' parameter of a POST request to /protect/config.htm. The payload is stored in the database and executed when accessed.
Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
AUO Solar Data Recorder all versions prior to v1.3.0
Auth required
Prerequisites:
Access to the /protect/config.htm endpoint · Valid authentication credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://drive.google.com/open?id=1X42Rdb_u4YVieXRqs0jOjyJZOb7DCJT6
Exploit, Third Party Advisory x_refsource_misc
https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11368
Scores
CVSS v3
5.4
EPSS
0.0158
EPSS Percentile
72.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
auo/solar_data_recorder
< 1.3.0
Published
Jun 03, 2019
Tracked Since
Feb 18, 2026