CVE-2018-1000998

FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x.

• CWE-79

• https://www.kvakil.me/posts/cvsweb/Exploit, Third Party Advisory
• https://www.kvakil.me/posts/cvsweb/Exploit, Third Party Advisory

Published

Feb 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000889Logisim Evolution version 2.14.3 and earlier contains an XML…
• CVE-2018-1000890FrontAccounting 2.4.5 contains a Time Based Blind SQL Inject…
• CVE-2018-1000891Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000892Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000893Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000997A path traversal vulnerability exists in the Stapler web fra…
• CVE-2018-1000999Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1001A remote code execution vulnerability exists in the way that…
• CVE-2018-10016Netwide Assembler (NASM) 2.14rc0 has a division-by-zero vuln…
• CVE-2018-10017soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopen…6.5
• CVE-2018-10018The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G…
• CVE-2018-1002000There is blind SQL injection in WordPress Arigato Autorespon…