CVE-2018-16251

2019-06-2014:15:10

Google

osv.dev

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

25.0%

JSON

A “search for user discovery” injection issue exists in Creatiwity wityCMS 0.6.2 via the “Utilisateur” menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.

CPENameOperatorVersion
witycmseq0.3.0
witycmseq0.6.0-beta1
witycmseq0.5.0
witycmseq0.6.1
witycmseq0.6.2
witycmseq0.4.0
witycmseq0.6.0

Name	Operator	Version
witycms	eq	0.3.0
witycms	eq	0.6.0-beta1
witycms	eq	0.5.0
witycms	eq	0.6.1
witycms	eq	0.6.2
witycms	eq	0.4.0
witycms	eq	0.6.0

References

github.com/Creatiwity/wityCMS/issues/157