CVE-2019-10257

7.5 highEPSS 2.4%

High (7.5) in zucchetti hr portal. EPSS 2.4% chance of exploitation in the next 30 days.

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restricted location (dot-dot-slash notation) to access files or directories that are elsewhere on the system. Through this vulnerability it is possible to read the application's java sources from /WEB-INF/classes/*.class

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-06-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zucchetti:hr_portal

References

http://www.sk-it.com/en/cve.html
http://www.sk-it.com/en/cve.html

Check your stack JSON