CVE-2019-19736

—

CVSS 3.1

6.1 medium

EPSS

<1%p47

Published

Dec 30, 2019 (Dec 30, 2019)

Modified

Jun 17, 2026

Description

MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which can potentially be used by attackers to obtain the cookie via cross-site scripting.

Vendors: mfscripts
Products: yetishare
Weakness: CWE-732
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.