CVE-2019-8954: Indexhibit

High severity, CVSS 8.8. EPSS: 2.7% chance of exploitation in the next 30 days.

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.

Affected products

• Indexhibit Indexhibit: version 2.1.5 only

Published 2019-02-20. Last modified 2026-06-17.