CVE-2018-19546

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-195476.1JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.CVE-2018-195489.8index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameterCVE-2018-195498.8Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php.CVE-2018-195508.8Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, wCVE-2018-195518.8Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.CVE-2018-195528.8Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.CVE-2018-195538.8Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.phpCVE-2018-195545.4An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in htmlCVE-2018-195558.8tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.CVE-2018-195564.3zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainerCVE-2018-195579.8An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images.CVE-2018-195589.8An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php
CVE-2018-19546: High severity, CVSS 8.8 | Vulnix