CVE-2018-25350

CriticalCVSS 9.8/10Last modified Oct 6, 2026

Description

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-204

Affected software

VendorProductVersions
UserSpiceuserSpice4.3.24

References

Timeline

Published
May 23, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-253518.2Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitraCVE-2018-253527.1WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackCVE-2018-253538.8Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file exCVE-2018-253544.3Joomla Component jomres 9.11.2 contains a cross-site request forgery vulnerability that allows attackers to modify user account information CVE-2018-253558.4Audiograbber 1.83 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting structured exCVE-2018-253568.4SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash tCVE-2018-253579.8Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injCVE-2018-253587.5D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuratioCVE-2018-253598.4Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate priviCVE-2018-253608.4AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route host name field that allows local attaCVE-2018-253616.8Soroush IM Desktop App 0.17.0 contains an authentication bypass vulnerability that allows local attackers to remove passcodes by injecting pCVE-2018-253628.2Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL c
CVE-2018-25350: Critical severity, CVSS 9.8 | Vulnix