CVE-2018-14950

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-149516.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.CVE-2018-149526.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.CVE-2018-149536.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.CVE-2018-149546.1The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.CVE-2018-149556.1The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).CVE-2018-149569.8CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sensCVE-2018-149579.8CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_documeCVE-2018-149588.8An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.CVE-2018-149598.8An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.CVE-2018-14965.4IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2018-149608.8Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.CVE-2018-149619.8dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
CVE-2018-14950: Medium severity, CVSS 6.1 | Vulnix