Critical
Security advisory
Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-19249
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 10:38 UTC · Revision 1
Source evidence
Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations.
osv:CVE-2019-19249
Complete source record
{
"id": "330269790ece92f1bb0f10ac348b6ef2a0fcab8a505dc18d2c650d4d7aebd822",
"url": "https://osv.dev/vulnerability/CVE-2019-19249",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-19249",
"summary": "Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations.",
"evidence": "osv:CVE-2019-19249",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-19249",
"aliases": [
"CVE-2019-19249"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/d4software/querytree",
"type": "GIT",
"events": [
{
"introduced": "1751f9001a86ade39035740572fed694386e9ce9"
},
{
"last_affected": "57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f"
},
{
"fixed": "57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.11:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.11-beta"
},
{
"last_affected": "3.0.11-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.13:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.13-beta"
},
{
"last_affected": "3.0.13-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.15:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.15-beta"
},
{
"last_affected": "3.0.15-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.17:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.17-beta"
},
{
"last_affected": "3.0.17-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.19:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.19-beta"
},
{
"last_affected": "3.0.19-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.21:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.21-beta"
},
{
"last_affected": "3.0.21-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.25:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.25-beta"
},
{
"last_affected": "3.0.25-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.27:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.27-beta"
},
{
"last_affected": "3.0.27-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.29:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.29-beta"
},
{
"last_affected": "3.0.29-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.31:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.31-beta"
},
{
"last_affected": "3.0.31-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.36:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.36-beta"
},
{
"last_affected": "3.0.36-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.39:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.39-beta"
},
{
"last_affected": "3.0.39-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.41:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.41-beta"
},
{
"last_affected": "3.0.41-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.43:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.43-beta"
},
{
"last_affected": "3.0.43-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.45:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.45-beta"
},
{
"last_affected": "3.0.45-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.49:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.49-beta"
},
{
"last_affected": "3.0.49-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.51:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.51-beta"
},
{
"last_affected": "3.0.51-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.53:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.53-beta"
},
{
"last_affected": "3.0.53-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.55:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.55-beta"
},
{
"last_affected": "3.0.55-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.57:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.57-beta"
},
{
"last_affected": "3.0.57-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.59:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.59-beta"
},
{
"last_affected": "3.0.59-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.61:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.61-beta"
},
{
"last_affected": "3.0.61-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.63:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.63-beta"
},
{
"last_affected": "3.0.63-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.65:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.65-beta"
},
{
"last_affected": "3.0.65-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.69:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.69-beta"
},
{
"last_affected": "3.0.69-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.71:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.71-beta"
},
{
"last_affected": "3.0.71-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.73:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.73-beta"
},
{
"last_affected": "3.0.73-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.76:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.76-beta"
},
{
"last_affected": "3.0.76-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.79:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.79-beta"
},
{
"last_affected": "3.0.79-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.83:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.83-beta"
},
{
"last_affected": "3.0.83-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.85:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.85-beta"
},
{
"last_affected": "3.0.85-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.88:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.88-beta"
},
{
"last_affected": "3.0.88-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.90:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.90-beta"
},
{
"last_affected": "3.0.90-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.92:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.92-beta"
},
{
"last_affected": "3.0.92-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.95:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.95-beta"
},
{
"last_affected": "3.0.95-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.97:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.97-beta"
},
{
"last_affected": "3.0.97-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:querytreeapp:querytree:3.0.99:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.99-beta"
},
{
"last_affected": "3.0.99-beta"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.0.11-beta",
"3.0.13-beta",
"3.0.15-beta",
"3.0.17-beta",
"3.0.19-beta",
"3.0.21-beta",
"3.0.25-beta",
"3.0.27-beta",
"3.0.29-beta",
"3.0.31-beta",
"3.0.36-beta",
"3.0.39-beta",
"3.0.41-beta",
"3.0.43-beta",
"3.0.45-beta",
"3.0.49-beta",
"3.0.51-beta",
"3.0.53-beta",
"3.0.55-beta",
"3.0.57-beta",
"3.0.59-beta",
"3.0.61-beta",
"3.0.63-beta",
"3.0.65-beta",
"3.0.69-beta",
"3.0.71-beta",
"3.0.73-beta",
"3.0.76-beta",
"3.0.79-beta",
"3.0.83-beta",
"3.0.85-beta",
"3.0.88-beta",
"3.0.90-beta",
"3.0.92-beta",
"3.0.95-beta",
"3.0.97-beta",
"3.0.99-beta"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19249.json"
}
}
],
"modified": "2026-10-20T10:50:51.751358894Z",
"provider": "osv",
"references": [
"https://github.com/d4software/QueryTree/compare/3.0.97-beta...3.0.99-beta",
"https://github.com/d4software/QueryTree/commit/57b700823f8eb1a42eb3bc0c706fbe5e5f5e766f"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-19249",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 382267,
"published_at": "2019-11-25T17:15:11.993+00:00"
}