High severity8.8NVD Advisory· Published Dec 30, 2019· Updated Jun 17, 2026
CVE-2019-19734
CVE-2019-19734
Description
_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection.
Affected products
3- MFScripts/YetiSharedescription
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.