CVE-2018-11343

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2018/May/2Exploit, Mailing List, Third Party Advisory
https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Issue Tracking, Third Party Advisory
http://seclists.org/fulldisclosure/2018/May/2Exploit, Mailing List, Third Party Advisory
https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-113446.5A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the syste CVE-2018-113458.8An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the P CVE-2018-113464.3An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "dow CVE-2018-113478.8The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject,CVE-2018-113485.4Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By i CVE-2018-113498.8The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: search_by_name, search_by_h CVE-2018-11356.5An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle fil CVE-2018-113506.1An issue was discovered in Jirafeau before 3.4.1. The file "search by name" form is affected by one Cross-Site Scripting vulnerability via t CVE-2018-113516.1script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared CVE-2018-113524.0The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration CVE-2018-113547.5In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain corr CVE-2018-113557.5In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for pa