CVE-2018-12711

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/104565Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041244Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/740-20180602-core-xss-vulnerability-in-language-switcher-moduleVendor Advisory
http://www.securityfocus.com/bid/104565Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041244Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/740-20180602-core-xss-vulnerability-in-language-switcher-moduleVendor Advisory

Timeline

Published: Jun 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-127128.8An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exist CVE-2018-127139.1GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demon CVE-2018-127149.8An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no CVE-2018-127156.1DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.CVE-2018-127164.3The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_resu CVE-2018-12727.5Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support f CVE-2018-12739.8Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit CVE-2018-127357.5SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter_info.htm or eng CVE-2018-127398.8In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.CVE-2018-12747.5Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability ca CVE-2018-12759.8Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose CVE-2018-127549.8Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-boun