CVE-2018-18674

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_update.php bo_content_tail parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-653a2b5a93ed2ca9b8c809ba723638c1Patch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172Patch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0Release Notes, Third Party Advisory
https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-653a2b5a93ed2ca9b8c809ba723638c1Patch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172Patch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0Release Notes, Third Party Advisory

Timeline

Published: Nov 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-186756.1GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" paramete CVE-2018-186766.1GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter CVE-2018-186786.1GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" pa CVE-2018-186885.3The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat CVE-2018-186895.3The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat CVE-2018-186905.5In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational unt CVE-2018-186926.1A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML CVE-2018-186944.8admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content CVE-2018-186957.8M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file.CVE-2018-186968.8main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF a CVE-2018-186989.8An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords i CVE-2018-186998.8An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.