CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tag[tag] parameter to the index.php?m=tags&f=index&v=add&&_su=wuzhicms URI. After a website editor (whose privilege is lower than the administrator) logs in, he can add a new TAGS with the XSS payload.

• CWE-79

• https://github.com/wuzhicms/wuzhicms/issues/129Exploit, Third Party Advisory
• https://github.com/wuzhicms/wuzhicms/issues/129Exploit, Third Party Advisory

Published

Apr 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10211An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10212An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10213An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10219baijiacms V3 has physical path leakage via an index.php?mod=…
• CVE-2018-1022A remote code execution vulnerability exists in the way the …
• CVE-2018-10220Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php …
• CVE-2018-10222An issue was discovered in idreamsoft iCMS V7.0. There is a …
• CVE-2018-10223An issue was discovered in YzmCMS 3.8. There is a CSRF vulne…
• CVE-2018-10224An issue was discovered in YzmCMS 3.8. There is a CSRF vulne…
• CVE-2018-10225thinkphp 3.1.3 has SQL Injection via the index.php s paramet…
• CVE-2018-10227MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link pa…
• CVE-2018-10228Cross-site scripting (XSS) vulnerability in /application/con…6.1