CVE-2019-19491

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.16.1Medium EPSS percentile56th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2019-12-02Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your TestLink installation is version 1.9.19 and whether staff can access it from the internet.
Restrict TestLink access to trusted staff networks or a virtual private network, and warn users not to open unexpected TestLink links.
There is no confirmed fixed version or vendor patch information available; ask your software vendor for a supported upgrade or mitigation.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request.

In plain language

Written by AI from the record

TestLink 1.9.19 can be used to run unwanted code in a visitor’s browser, so small businesses using that version should limit access and plan mitigation because no fix is known.

CVE-2019-19491 is a reflected cross-site scripting vulnerability in TestLink 1.9.19 through the archiveData.php edit parameter, index.php reqURI parameter, and a tcEdit.php delete-step request URI.

If you're affected

Test-management account misuse
Test data exposure
Unauthorized changes in browser
Disrupted testing operations

What is it

This flaw can let a malicious link cause unwanted actions inside a person’s web browser while they use TestLink. It is like slipping a fake instruction into a document that a staff member opens: the instruction can act using that person’s access.

Who is affected

This matters to you if you run TestLink version 1.9.19. It is most relevant where employees use the system through a web browser; the attack requires getting someone to open a crafted TestLink web address.

How urgent is it

A public attack example is available, so treat this as an active maintenance issue rather than a theoretical defect. It is amber urgency because successful use depends on persuading a user to open a malicious link, but no vendor fix information is available.

What to do — in detail

Confirm the deployed TestLink version, including any internet-facing instances, reverse proxies, and alternate URLs used by staff.
Treat TestLink 1.9.19 as affected. No fixed version or supported patch branch is identified in the available findings, so do not assume that an unverified upgrade resolves this CVE.
If patching is delayed, remove public access where feasible; allow access only through a VPN or trusted network, and restrict the service to users who need it.
Review web-server and application logs for unusual requests to lib/testcases/archiveData.php, index.php with unexpected reqURI values, and lib/testcases/tcEdit.php?doAction=doDeleteStep.
Ask the TestLink maintainer or your support provider for a supported remediation path. No CISA KEV due date applies because this CVE is not listed in KEV.

Technical context

CVSS v3.1 is 6.1 (Medium): AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is CWE-79, reflected XSS, with injection points in the edit parameter, reqURI parameter, and delete-step request URI. One public exploit is known. CISA KEV does not list this CVE. EPSS predicts 0.8% likelihood (55th percentile) with a flat trend; this is a prediction, not evidence of exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS56th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 56th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 2286 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: exploit-db
2024-11-21Record updated
2019-12-02Publishedweakness classified, att&ck mapped

Affected products

testlinkoss-project
- testlinkOn-premDevTools & CI / build-test-tools

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Scored 6.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact