CVE-2018-10295

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ChemCMS v1.0.6 has CSRF by using public/admin/user/addpost.html to add an administrator account.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-102966.1MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.CVE-2018-102975.4Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI, related to mishandling of IMG elements associateCVE-2018-102985.4Discuz! DiscuzX through X3.4 has reflected XSS via forum.php?mod=post&action=newthread because data/template/1_diy_portal_view.tpl.php does CVE-2018-102997.5An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin (BEC), the Ethereum ERC20 tokCVE-2018-10308.8A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka CVE-2018-103006.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inCVE-2018-103016.1Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackeCVE-2018-103027.8A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-jCVE-2018-103038.8A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 allows remote attackers to execute arbitrary code, aka iDefense ID V-yCVE-2018-103059.8The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum (SMF) before 2.0.15 does not properly use the possible_users varCVE-2018-103066.1Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x bCVE-2018-103076.1error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.
CVE-2018-10295: High severity, CVSS 8.8 | Vulnix