CVE-2018-25250

MediumCVSS 6.1/10Last modified Jul 24, 2026

Description

MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts by crafting thread subjects with script tags. Attackers can create threads with script payloads in the subject field that execute when users visit the attacker's profile page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-252518.4Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attackers to trigger a struCVE-2018-252525.5FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized buCVE-2018-252535.5Termite 3.4 contains a buffer overflow vulnerability in the User interface language settings field that allows local attackers to cause a deCVE-2018-252549.8NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary coCVE-2018-252558.410-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local attackers to executCVE-2018-252565.5IP TOOLS 2.50 contains a local buffer overflow vulnerability in the SNMP Scanner component that allows local attackers to crash the applicatCVE-2018-252577.1Adianti Framework 5.5.0 and 5.6.0 contains an SQL injection vulnerability that allows authenticated users to manipulate database queries by CVE-2018-252588.4RGui 3.5.0 contains a local buffer overflow vulnerability in the GUI preferences dialog that allows attackers to bypass DEP protections throCVE-2018-252597.8Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers tCVE-2018-252607.8MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local attackers to execute arCVE-2018-252617.8Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism that allows local aCVE-2018-252625.5Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplyin
CVE-2018-25250: Medium severity, CVSS 6.1 | Vulnix