CVE-2019-16960
MEDIUMSolarWinds Web Help Desk 12.7.0 - Stored Cross-Site Scripting via CSV Template Location Name Field
Title source: llmDescription
SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
https://support.solarwinds.com/SuccessCenter/s/
Product, Vendor Advisory x_refsource_misc
https://www.solarwinds.com/free-tools/free-help-desk-software
Exploit, Third Party Advisory x_refsource_misc
https://www.esecforte.com/responsible-vulnerability-disclosure-cve-2019-16960-cross-site-scripting-vulnerability-in-solarwinds-web-help-desk/
Scores
CVSS v3
5.4
EPSS
0.0193
EPSS Percentile
83.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
solarwinds/web_help_desk
12.7.0
Published
Jan 04, 2021
Tracked Since
Feb 18, 2026