Cross-site Scripting in MobileDetect

🗓️ 04 Feb 2023 09:30:21Reported by GitHub Advisory DatabaseType

A cross-site scripting vulnerability in MobileDetect 2.8.31 allows remote attackers to manipulate the $_SERVER['PHP_SELF'] argument in file examples/session_example.php, leading to a problematic issue in the component Example. Upgrading to version 2.8.32 with patch 31818a441b095bdc4838602dbb17b8377d1e5cce is recommended to address this issue

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2018-25080	4 Feb 202312:21	–	circl
CNNVD	MobileDetect 跨站脚本漏洞	4 Feb 202300:00	–	cnnvd
CVE	CVE-2018-25080	4 Feb 202307:57	–	cve
Cvelist	CVE-2018-25080 MobileDetect Example session_example.php initLayoutType cross site scripting	4 Feb 202307:57	–	cvelist
Exploit DB	MobileDetect 2.8.31 - Cross-Site Scripting (XSS)	3 Dec 202500:00	–	exploitdb
EUVD	EUVD-2023-0788	3 Oct 202520:07	–	euvd
NVD	CVE-2018-25080	4 Feb 202308:15	–	nvd
OSV	CVE-2018-25080	4 Feb 202308:15	–	osv
OSV	GHSA-R77C-QV68-J3PP Cross-site Scripting in MobileDetect	4 Feb 202309:30	–	osv
Packet Storm	📄 MobileDetect 2.8.31 Cross Site Scripting	3 Dec 202500:00	–	packetstorm

Vulners

Node

mobiledetect mobiledetectlibRange<2.8.32composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-25080
github	www.github.com/serbanghita/Mobile-Detect/pull/741
github	www.github.com/serbanghita/Mobile-Detect/commit/31818a441b095bdc4838602dbb17b8377d1e5cce
github	www.github.com/serbanghita/Mobile-Detect/releases/tag/2.8.32
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2018-25080.md
github	www.github.com/advisories/GHSA-r77c-qv68-j3pp

16 Apr 2025 16:13Current

2.1Low risk

Vulners AI Score2.1

CVSS 3.13.5 - 6.1

CVSS 24

CVSS 33.5

EPSS0.02149

CWE-79