CVE-2018-7465

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-74667.5install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN CVE-2018-74677.5AxxonSoft Axxon Next has Directory Traversal via an initial /css//..%2f substring in a URI.CVE-2018-74694.8PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XSS via the p_name (aka Edit Category Name) field to admin/categories_industry.php CVE-2018-74706.5An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsWEBPImageLossless function in coders/webp.c allows attackers to cause a denial of CVE-2018-74717.8KingView 7.5SP1 has an integer overflow during stgopenstorage API read operations.CVE-2018-74725.5INVT Studio 1.2 allows remote attackers to cause a denial of service during import operations.CVE-2018-74736.1Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users CVE-2018-74749.8An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.CVE-2018-74756.1Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary w CVE-2018-74766.1controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage,m=import req CVE-2018-74779.8SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent CVE-2018-74795.3YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php.