CVE-2018-25249

MediumCVSS 6.4/10Last modified Jul 21, 2026

Description

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-252506.1MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject mali CVE-2018-252518.4Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attackers to trigger a stru CVE-2018-252525.5FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized bu CVE-2018-252535.5Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a de CVE-2018-252549.8NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary co CVE-2018-252558.410-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to execut CVE-2018-252565.5IP TOOLS 2.50 contains a local buffer overflow vulnerability in the SNMP Scanner component that allows local attackers to crash the applicat CVE-2018-252577.1Adianti Framework 5.5.0 and 5.6.0 contains an SQL injection vulnerability that allows authenticated users to manipulate database queries by CVE-2018-252588.4RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections thro CVE-2018-252597.8Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers t CVE-2018-252607.8MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute ar CVE-2018-252617.8Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local a