CVE-2019-19738

The CVE-2019-19738 entry applies to Mellow Fish YetiShare (MFScripts) 3.5.2 through 4.5.3. The root cause is that log_file_viewer.php does not sanitize or encode the output from the lFile parameter, allowing an attacker to inject HTML or scripts (XSS) on the page. The connected Red Hat and CNVD r...

CVE-2019-19733

CVE-2019-19733 affects MFScripts YetiShare, version range 3.5.2 through 4.5.3. The vulnerability lies in the file get_all_file_server_paths.ajax.php where output derived from the client-supplied fileIds parameter is not sanitized/encoded, enabling an attacker to inject HTML or script code on the ...

CVE-2019-19736

CVE-2019-19736 concerns MFScripts YetiShare 3.5.2–4.5.3 where session cookies lack the HttpOnly flag, enabling potential script access and cookie theft via cross-site scripting. Affected component: server-side session handling in YetiShare; root cause: absence of HttpOnly on cookies. Impact: risk...