CVE-2018-6870

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-68719.8LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which useCVE-2018-68725.5The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows CVE-2018-68739.8The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.CVE-2018-68748.8CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.CVE-2018-68757.5Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be acceCVE-2018-68766.5The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackersCVE-2018-68785.4Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or descripCVE-2018-68798.8PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers CVE-2018-68805.3EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php.CVE-2018-68815.3EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.CVE-2018-68826.1Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 CVE-2018-68834.9Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags
CVE-2018-6870: Medium severity, CVSS 6.1 | Vulnix