CVE-2018-18417

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45681/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45681/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-184195.4Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account CVE-2018-18423.6IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. CVE-2018-184208.8Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organiz CVE-2018-184228.8UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.CVE-2018-184256.5The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship bet CVE-2018-184268.8s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.ph CVE-2018-184279.8s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.CVE-2018-184287.5TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.CVE-2018-18434.1The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange informatio CVE-2018-184304.8An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.CVE-2018-184314.8An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.CVE-2018-184328.8An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request.