CVE-2018-6377

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/102917Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040316Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/720-20180103-core-xss-vulnerability.htmlVendor Advisory
http://www.securityfocus.com/bid/102917Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040316Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/720-20180103-core-xss-vulnerability.htmlVendor Advisory

Timeline

Published: Jan 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63786.1In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.CVE-2018-63796.1In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.CVE-2018-63806.1In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.CVE-2018-63816.5In ZZIPlib 0.13.67, 0.13.66, 0.13.65, 0.13.64, 0.13.63, 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57 and 0.13.56 there is a segmenta CVE-2018-63823.3MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to CVE-2018-63838.8Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha CVE-2018-63847.8Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with el CVE-2018-63879.8iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of sup CVE-2018-63888.8iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metachara CVE-2018-63897.5In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist CVE-2018-63906.5The WStr::assign function in kso.dll in Kingsoft WPS Office 10.1.0.7106 and 10.2.0.5978 does not validate the size of the source memory bloc CVE-2018-63918.8A cross-site request forgery web vulnerability has been discovered on Netis WF2419 V2.2.36123 devices. A remote attacker is able to delete A