CVE-2018-11628

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/104428Third Party Advisory, VDB Entry
https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htmRelease Notes
https://gist.github.com/barrett092/c70752ca6960b8b9616a03006f291a28Third Party Advisory
https://www.exploit-db.com/exploits/44831/Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/104428Third Party Advisory, VDB Entry
https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htmRelease Notes
https://gist.github.com/barrett092/c70752ca6960b8b9616a03006f291a28Third Party Advisory
https://www.exploit-db.com/exploits/44831/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jun 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-116299.8Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT de CVE-2018-11639.8This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The spec CVE-2018-116314.3Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluet CVE-2018-116326.5An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user CVE-2018-116336.5An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visit CVE-2018-116347.8Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web CVE-2018-116359.8Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrativ CVE-2018-116368.8Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers CVE-2018-116377.5Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbit CVE-2018-116387.2Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authe CVE-2018-116398.1Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialo CVE-2018-11649.8This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router