CVE-2019-19634
CRITICALverot.net class.upload <2.0.4 - Info Disclosure
Title source: llmDescription
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Exploits (1)
References (3)
Scores
CVSS v3
9.8
EPSS
0.1495
EPSS Percentile
94.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (3)
getk2/k2
< 2.10.1
verot/class.upload.php
0Packagist
verot_project/verot
< 1.0.3
Published
Dec 17, 2019
Tracked Since
Feb 18, 2026