VULNERABILITY INTELLIGENCE

CVE-2018-11512

CVSS score4.8 MEDIUM

EPSS probability2.10%

CISA KEVNot currently listed

Published2018-05-28

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

cve@mitre.org — Patch
cve@mitre.org — Exploit, Issue Tracking, Patch, Third Party Advisory
cve@mitre.org — Exploit, Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory, VDB Entry