# CVEs published 2019-06-15

8 CVEs were published on June 15, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2013-7472](https://cve.now/CVE-2013-7472.md): The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd\_metaboxes daytoshow parameter. (no CVSS)
- [CVE-2019-12840](https://cve.now/CVE-2019-12840.md): In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the dat (no CVSS)
- [CVE-2019-12839](https://cve.now/CVE-2019-12839.md): In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows (no CVSS)
- [CVE-2019-12835](https://cve.now/CVE-2019-12835.md): formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml\_memory\_writer::write via characters that require escapin (no CVSS)
- [CVE-2019-12831](https://cve.now/CVE-2019-12831.md): In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too l (no CVSS)
- [CVE-2019-12830](https://cve.now/CVE-2019-12830.md): In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to \[video\] BBCode persistent (no CVSS)
- [CVE-2019-12829](https://cve.now/CVE-2019-12829.md): radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly (no CVSS)
- [CVE-2019-12816](https://cve.now/CVE-2019-12816.md): Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-06-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.