{"id":"CVE-2019-5748","details":"In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.","modified":"2026-07-08T19:03:14.677756Z","published":"2019-01-09T17:29:00.293Z","references":[{"type":"ADVISORY","url":"https://www.traccar.org/blog/"},{"type":"FIX","url":"https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/traccar/traccar","events":[{"introduced":"25b6d4fe524f41ae9a37d7b57a2c4f0e8e1dfa25"},{"last_affected":"25b6d4fe524f41ae9a37d7b57a2c4f0e8e1dfa25"},{"fixed":"d7f6c53fd88635885914013649b6807ec53227bf"}],"database_specific":{"cpe":"cpe:2.3:a:traccar:server:4.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.2"},{"last_affected":"4.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["4.2","v4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5748.json","vanir_signatures_modified":"2026-07-08T19:03:14Z","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["64744398024010156530414990151867324035","103094106067725634274456181224152056068","137370831289664590268145846107581954716","290240703078587816964598778996448964437","101689998601590319437863611412017325679"]},"id":"CVE-2019-5748-bd546df7","signature_type":"Line","signature_version":"v1","source":"https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf","target":{"file":"src/org/traccar/protocol/SpotProtocolDecoder.java"}},{"id":"CVE-2019-5748-e794ca27","signature_type":"Function","signature_version":"v1","source":"https://github.com/traccar/traccar/commit/d7f6c53fd88635885914013649b6807ec53227bf","target":{"file":"src/org/traccar/protocol/SpotProtocolDecoder.java","function":"SpotProtocolDecoder"},"deprecated":false,"digest":{"function_hash":"244839823815014023820227176207891796806","length":346}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}