Web Port 1.19.1 allows XSS via the /log type parameter.
Priority LOW 39CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Web Port 1.19.1 allows XSS via the /log type parameter.
Why it matters now
EPSS 0.09872 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12461
- 2026-10-03 Alias added: GHSA-6xp2-37x8-82p9
- 2026-10-31 Priority changed: MEDIUM → LOW
References
More Webport Web Port vulnerabilities
- TI-2019-09302 Web Port 1.19.1 allows XSS via the /access/setup type parameter. CVSS 3.0MEDIUM 6.1
- TI-2020-13429 Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings. CVSS 3.1MEDIUM 5.3
- TI-2020-13431 Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls. CVSS 3.1MEDIUM 5.4
- TI-2020-13428 Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn. CVSS 3.1MEDIUM 5.4
- TI-2020-14635 WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the "connections" feature. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2019-12461 · CVE Program
- CVE-2019-12461 · NVD
- FIRST EPSS
- GHSA-6xp2-37x8-82p9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences