CVE-2018-14512

2018-07-2308:29:00

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.8%

JSON

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[nickname] parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the “system settings - mail server” screen, the XSS payload is triggered.

CPENameOperatorVersion
wuzhicmseq3.0.3
wuzhicmseq3.0.3.0
wuzhicmseq3.0.1
wuzhicmseq3.1.3
wuzhicmseq3.1.1
wuzhicmseq2.0.1
wuzhicmseq3.0.4
wuzhicmseq2.0.4
wuzhicmseq2.1.7
wuzhicmseq3.0.4.0

Name	Operator	Version
wuzhicms	eq	3.0.3
wuzhicms	eq	3.0.3.0
wuzhicms	eq	3.0.1
wuzhicms	eq	3.1.3
wuzhicms	eq	3.1.1
wuzhicms	eq	2.0.1
wuzhicms	eq	3.0.4
wuzhicms	eq	2.0.4
wuzhicms	eq	2.1.7
wuzhicms	eq	3.0.4.0

Rows per page:

1-10 of 201

References

github.com/wuzhicms/wuzhicms/issues/143