CVE-2018-7663

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile (resources/views/layouts/app.blade.php) allows for server-side template injection of arbitrary JavaScript.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/spencerdodd/public-writeups/blob/master/CVE-2018-7663/README.mdExploit, Third Party Advisory
https://github.com/voten-co/voten/commit/ee6a322568166e28465da075159a6d4adbf74d53Patch, Third Party Advisory
https://github.com/spencerdodd/public-writeups/blob/master/CVE-2018-7663/README.mdExploit, Third Party Advisory
https://github.com/voten-co/voten/commit/ee6a322568166e28465da075159a6d4adbf74d53Patch, Third Party Advisory

Timeline

Published: Mar 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-76649.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name p CVE-2018-76659.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_up CVE-2018-76669.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/vote_channel.php channel CVE-2018-76679.8Adminer through 4.3.1 has SSRF via the server parameter.CVE-2018-76687.5TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload CVE-2018-76697.5An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a CVE-2018-76737.5The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.CVE-2018-76746.1The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection.CVE-2018-76755.3In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the u CVE-2018-76765.9The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information.CVE-2018-76778.8A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component.CVE-2018-76784.8A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.