{"id":"CVE-2019-15071","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-15071","generatedAt":"2026-10-28T20:26:39.016Z","title":"The \"/cgi-bin/go\" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication.","description":"The \"/cgi-bin/go\" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.","published":"2019-11-20T04:15:11.000Z","lastModified":"2026-06-17T02:19:39.000Z","status":"Modified","sourceIdentifier":"twcert@cert.org.tw","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["openfind/mail2000"],"epss":{"score":0.01628,"percentile":0.76046,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://tvn.twcert.org.tw/taiwanvn/TVN-201909001","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf","source":"twcert@cert.org.tw"},{"url":"https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf","source":"twcert@cert.org.tw"},{"url":"https://www.openfind.com.tw/taiwan/resource.html","tags":["Product","Vendor Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://gist.github.com/chtsecurity/21119b393640bea1d010ab9e3bee216d","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gist.github.com/tonykuo76/95638395e0c83e68dbd3db0fa0184e27","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tvn.twcert.org.tw/taiwanvn/TVN-201909001","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.chtsecurity.com/download/5011077112c76fb73f82d7eeb2b41b3bcd06c5037be242fec7b185603ca52dc1.txt","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-004.pdf","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openfind.com.tw/taiwan/download/m2k/patch/Openfind_OF-ISAC-19-005.pdf","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openfind.com.tw/taiwan/resource.html","tags":["Product","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.twcert.org.tw/en/cp-128-3085-45bda-2.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-15071","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}