CVE-2018-11512

Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.

• CWE-79

• https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44Patch
• https://github.com/Creatiwity/wityCMS/issues/150Exploit, Issue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/44790/Exploit, Patch, Third Party Advisory, VDB Entry
• https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44Patch
• https://github.com/Creatiwity/wityCMS/issues/150Exploit, Issue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/44790/Exploit, Patch, Third Party Advisory, VDB Entry

Published

May 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11507An issue was discovered in Free Lossless Image Format (FLIF)…
• CVE-2018-11508The compat_get_timex function in kernel/compat.c in the Linu…
• CVE-2018-11509ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin user…
• CVE-2018-1151The web server on Western Digital TV Media Player 1.03.07 an…
• CVE-2018-11510The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauth…
• CVE-2018-11511The tree list functionality in the photo gallery application…
• CVE-2018-11514PHP Scripts Mall Naukri Clone Script through 3.0.3 allows Un…
• CVE-2018-11515The wpForo plugin through 2018-02-05 for WordPress has SQL I…
• CVE-2018-11516The vlc_demux_chained_Delete function in input/demux_chained…8.8
• CVE-2018-11517mySCADA myPRO 7 allows remote attackers to discover all Proj…
• CVE-2018-11518A vulnerability allows a phreaking attack on HCL legacy IVR …
• CVE-2018-1152libjpeg-turbo 1.5.90 is vulnerable to a denial of service vu…