← Vulnerability feed

Vulnerability record · CVE-2018-19386 · published 14 August 2019

CVE-2018-19386: Solarwinds database performance analyzer cross-site scripting vulnerability

Solarwinds · Database Performance Analyzer

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.

6.1 CVSS 3.0 Medium EPSS 9.0% · top 4.9% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
9.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://i.imgur.com/Y7t2AD6.png ExploitThird Party Advisory
https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5 ExploitThird Party Advisory
https://i.imgur.com/Y7t2AD6.png ExploitThird Party Advisory
https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5 ExploitThird Party Advisory

Track CVE-2018-19386 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-23837Solarwinds database performance analyzer error message information leak vulnerabilityNo exception handling vulnerability which revealed sensitive or excessive information to users.EPSS 0.81%7.5CVE-2022-38112Solarwinds database performance analyzer cleartext storage of sensitive data vulnerabilityIn DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.EPSS 0.42%6.5CVE-2023-23838Solarwinds database performance analyzer path traversal vulnerabilityDirectory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.EPSS 1.3%6.4CVE-2025-26398Solarwinds database performance analyzer hard-coded credentials vulnerabilitySolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machin…EPSS 0.19%6.1CVE-2023-33231Solarwinds database performance analyzer cross-site scripting vulnerabilityXSS attack was possible in DPA 2023.2 due to insufficient input validationEPSS 0.50%6.1CVE-2021-35229Solarwinds database performance analyzer cross-site scripting vulnerabilityCross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL queryEPSS 3.2%5.4CVE-2022-38110Solarwinds database performance analyzer cross-site scripting vulnerabilityIn Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.EPSS 0.40%5.4CVE-2018-16243Solarwinds database performance analyzer cross-site scripting vulnerabilitySolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralM…EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2018-19386), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.