CVE-2019-3911
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 3.8%
exploitation probability
3.8%top 11% of all CVEs
observed exploitation
nono source reports it
Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.
Affected products
Tenable · LabKey Server Community Edition