CVE-2018-11321

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 22, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-113227.5An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP sCVE-2018-113238.8An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higherCVE-2018-113245.9An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updatesCVE-2018-113259.8An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validatCVE-2018-113264.8An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the CVE-2018-113274.3An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were either unpublished CVE-2018-113284.7An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and pCVE-2018-113297.5The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's CVE-2018-11338.8An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server,CVE-2018-113304.8An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly resCVE-2018-113319.8An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in CVE-2018-113324.8Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 al
CVE-2018-11321: Medium severity, CVSS 6.5 | Vulnix