CVE-2018-14958

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-149598.8An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.CVE-2018-14965.4IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2018-149608.8Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.CVE-2018-149619.8dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.CVE-2018-149625.4zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.CVE-2018-149638.8zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.CVE-2018-149645.4An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.CVE-2018-149658.8An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.CVE-2018-149668.8An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.CVE-2018-149678.8An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.CVE-2018-149689.8An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.CVE-2018-149694.8An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.
CVE-2018-14958: High severity, CVSS 8.8 | Vulnix