CVE-2019-19735 json
class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on micr…
published 2019-12-30 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9336
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/jra89/CVE-2019-19735 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-916 Use of Password Hash With Insufficient Computational Effort
References
-
github.com
/jra89/CVE-2019-19735
exploit, third-party-advisory
- medium.com /%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459
Sources
- CVE List CVE-2019-19735
- NVD CVE-2019-19735
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.