CVE-2018-18943

2018-11-0509:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.

CPENameOperatorVersion
basercmseqbasercms-3.0.6.1
basercmseqbasercms-4.0.5.2
basercmseqbasercms-4.1.2
basercmseqbasercms-4.0.8
basercmseqbasercms-4.0.0-beta
basercmseqbasercms-2.0.0
basercmseqbasercms-3.0.10
basercmseqbasercms-4.1.0.1
basercmseqbasercms-2.0.0-beta
basercmseqbasercms-4.0.11

Name	Operator	Version
basercms	eq	basercms-3.0.6.1
basercms	eq	basercms-4.0.5.2
basercms	eq	basercms-4.1.2
basercms	eq	basercms-4.0.8
basercms	eq	basercms-4.0.0-beta
basercms	eq	basercms-2.0.0
basercms	eq	basercms-3.0.10
basercms	eq	basercms-4.1.0.1
basercms	eq	basercms-2.0.0-beta
basercms	eq	basercms-4.0.11