CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.

• CWE-79

• https://www.vulnerability-lab.com/get_content.php?id=2123Exploit, Third Party Advisory
• https://www.vulnerability-lab.com/get_content.php?id=2123Exploit, Third Party Advisory

Published

Jun 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12995onefilecms.php in OneFileCMS through 2012-04-14 might allow …
• CVE-2018-12996A reflected Cross-site scripting (XSS) vulnerability in Zoho…
• CVE-2018-12997Incorrect Access Control in FailOverHelperServlet in Zoho Ma…7.5
• CVE-2018-12998A reflected Cross-site scripting (XSS) vulnerability in Zoho…6.1
• CVE-2018-12999Incorrect Access Control in AgentTrayIconServlet in Zoho Man…
• CVE-2018-1300Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-13001An XSS issue was discovered in Sandoba CP:Shop v2016.1. The …
• CVE-2018-13002An XSS issue was discovered in Inhaltsprojekte in Weblicatio…
• CVE-2018-13003An issue was discovered in OpenTSDB 2.3.0. There is XSS in p…
• CVE-2018-13005An issue was discovered in MP4Box in GPAC 0.7.1. The functio…
• CVE-2018-13006An issue was discovered in MP4Box in GPAC 0.7.1. There is a …
• CVE-2018-13007An issue was discovered in gpmf-parser 1.1.2. There is a hea…