{"id":"CVE-2019-10078","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-10078","generatedAt":"2026-10-29T00:59:11.331Z","title":"A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.","description":"A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.","published":"2019-05-20T21:29:01.000Z","lastModified":"2026-06-17T02:10:10.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["apache/jspwiki"],"epss":{"score":0.04937,"percentile":0.92099,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (4.94%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/05/19/6","source":"security@apache.org"},{"url":"http://www.securityfocus.com/bid/108437","source":"security@apache.org"},{"url":"https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/959811b776e1a332a1a4295405b683fd64190d079a7c3028f1c314d7%40%3Cdev.jspwiki.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2019/05/19/6","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/108437","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/24f324ef11e43ba89ec9aac3725a5ecd4289835639c476299e7660d9%40%3Cdev.jspwiki.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/959811b776e1a332a1a4295405b683fd64190d079a7c3028f1c314d7%40%3Cdev.jspwiki.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16%40%3Ccommits.jspwiki.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-10078","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}