CVE-2018-18678

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d87f2c71fb4fe131465ba1ff0a5d573dPatch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172Patch, Release Notes, Third Party Advisory
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0Release Notes, Third Party Advisory
https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d87f2c71fb4fe131465ba1ff0a5d573dPatch, Third Party Advisory
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172Patch, Release Notes, Third Party Advisory
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0Release Notes, Third Party Advisory

Timeline

Published: Oct 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-186885.3The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat CVE-2018-186895.3The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat CVE-2018-186905.5In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational unt CVE-2018-186926.1A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML CVE-2018-186944.8admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content CVE-2018-186957.8M2SOFT Report Designer Viewer 5.0 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via a crafted MRD file.CVE-2018-186968.8main.aspx in Microstrategy Analytics 10.4.0026.0049 and earlier has CSRF. NOTE: The vendor claims that documentation for preventing a CSRF a CVE-2018-186989.8An issue was discovered on Xiaomi Mi A1 tissot_sprout:8.1.0/OPM1.171019.026/V9.6.4.0.ODHMIFE devices. They store cleartext Wi-Fi passwords i CVE-2018-186998.8An issue was discovered in GoPro gpmf-parser 1.2.1. There is an out-of-bounds write in OpenMP4Source in GPMF_mp4reader.c.CVE-2018-187005.5An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability r CVE-2018-187015.5An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability r CVE-2018-187029.8spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decod