# CVEs published 2019-09-14

11 CVEs were published on September 14, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-16317](https://cve.now/CVE-2019-16317.md): In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter (no CVSS, pimcore/pimcore)
- [CVE-2019-16318](https://cve.now/CVE-2019-16318.md): In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonst (no CVSS, pimcore/pimcore)
- [CVE-2019-16307](https://cve.now/CVE-2019-16307.md): A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xe (no CVSS)
- [CVE-2019-16294](https://cve.now/CVE-2019-16294.md): SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafte (no CVSS)
- [CVE-2019-16309](https://cve.now/CVE-2019-16309.md): FlameCMS 3.3.5 has SQL injection in account/login.php via accountName. (no CVSS)
- [CVE-2019-16310](https://cve.now/CVE-2019-16310.md): NIUSHOP V1.11 has XSS via the index.php?s=/admin URI. (no CVSS)
- [CVE-2019-16311](https://cve.now/CVE-2019-16311.md): NIUSHOP V1.11 has CSRF via search_info to index.php. (no CVSS)
- [CVE-2019-16312](https://cve.now/CVE-2019-16312.md): s-cms V3.0 has XSS in index.php?type=text via the S\_id parameter. (no CVSS)
- [CVE-2019-16313](https://cve.now/CVE-2019-16313.md): ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. (no CVSS)
- [CVE-2019-16314](https://cve.now/CVE-2019-16314.md): Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2. (no CVSS)
- [CVE-2019-16305](https://cve.now/CVE-2019-16305.md): In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.