CVE-2019-3911: Labkey Server

Medium severity, CVSS 6.1. EPSS: 3.8% chance of exploitation in the next 30 days.

Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.

Affected products

• Labkey Labkey Server: before 18.3.0-61806.763 (fixed in 18.3.0-61806.763)

Published 2019-01-30. Last modified 2026-06-17.