CVE-2018-18290

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html&name=home_content allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality

• CWE-79

• https://github.com/gnat/nc-cms/issues/9Third Party Advisory
• https://github.com/gnat/nc-cms/issues/9Third Party Advisory

Published

Oct 14, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18285SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earli…
• CVE-2018-18286SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earli…
• CVE-2018-18287On ASUS RT-AC58U 3.0.0.4.380_6516 devices, remote attackers …
• CVE-2018-18288CrushFTP through 8.3.0 is vulnerable to credentials theft vi…6.1
• CVE-2018-18289The MESILAT Zabbix plugin before 1.1.15 for Atlassian Conflu…
• CVE-2018-1829IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable…5.4
• CVE-2018-18291A cross site scripting (XSS) vulnerability on ASUS RT-AC58U …
• CVE-2018-18296MetInfo 6.1.2 has XSS via the /admin/index.php bigclass para…
• CVE-2018-18307A Stored XSS vulnerability has been discovered in version 4.…
• CVE-2018-18308In the 4.2.23 version of BigTree, a Stored XSS vulnerability…
• CVE-2018-18309An issue was discovered in the Binary File Descriptor (BFD) …
• CVE-2018-18310An invalid memory address dereference was discovered in dwfl…5.5