VULNERABILITY INTELLIGENCE

CVE-2018-16805

CVSS score4.8 MEDIUM
EPSS probability0.76%
CISA KEVNot currently listed
Published2018-09-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references