CVE-2019-1332

MEDIUM

Microsoft SQL Server Reporting Services - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-1332. PoCs published by mbadanoiu.

AI-analyzed exploit summary The repository describes a reflected XSS vulnerability in Microsoft SQL Server Reporting Services but lacks actual exploit code, instead pointing to an external PDF for details. This is indicative of a social engineering lure rather than a legitimate PoC.

Description

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.

Exploits (1)

nomisec SUSPICIOUS
by mbadanoiu · poc
https://github.com/mbadanoiu/CVE-2019-1332

The repository describes a reflected XSS vulnerability in Microsoft SQL Server Reporting Services but lacks actual exploit code, instead pointing to an external PDF for details. This is indicative of a social engineering lure rather than a legitimate PoC.

Classification
Suspicious 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Theoretical
Target: Microsoft SQL Server Reporting Services
Auth required
Prerequisites: Authenticated SSRS user · User interaction (clicking a crafted link)
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0723
EPSS Percentile 93.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (3)
microsoft/power_bi_report_server
microsoft/sql_server_2017_reporting_services
microsoft/sql_server_2019_reporting_services
Published Dec 10, 2019
Tracked Since Feb 18, 2026