CVE-2018-5478

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-54796.1FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the seCVE-2018-54817.4OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances makiCVE-2018-54825.3NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can allow the transmissiCVE-2018-54857.8NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escCVE-2018-54867.8NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthCVE-2018-54879.8NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMCVE-2018-54889.8NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 1CVE-2018-54896.5NetApp 7-Mode Transition Tool allows users with valid credentials to access functions and information which may have been intended to be resCVE-2018-54908.8Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow moreCVE-2018-54929.8NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.CVE-2018-54937.5ATTO FibreBridge 7500N firmware versions prior to 2.90 are susceptible to a vulnerability which allows an unauthenticated remote attacker toCVE-2018-54959.8All StorageGRID Webscale versions are susceptible to a vulnerability which could permit an unauthenticated attacker to communicate with syst
CVE-2018-5478: Medium severity, CVSS 6.1 | Vulnix