CVE-2018-18308

In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).

• CWE-79

• http://packetstormsecurity.com/files/149788/BigTree-CMS-4.2.23-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://github.com/bigtreecms/BigTree-CMS/commit/ffd668a3aa7d2f540dbcdf5751f207302519df72Patch, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/issues/356Issue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/45628/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/149788/BigTree-CMS-4.2.23-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://github.com/bigtreecms/BigTree-CMS/commit/ffd668a3aa7d2f540dbcdf5751f207302519df72Patch, Third Party Advisory
• https://github.com/bigtreecms/BigTree-CMS/issues/356Issue Tracking, Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/45628/Third Party Advisory, VDB Entry

Published

Oct 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18289The MESILAT Zabbix plugin before 1.1.15 for Atlassian Conflu…
• CVE-2018-1829IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable…5.4
• CVE-2018-18290An issue was discovered in nc-cms through 2017-03-10. index.…
• CVE-2018-18291A cross site scripting (XSS) vulnerability on ASUS RT-AC58U …
• CVE-2018-18296MetInfo 6.1.2 has XSS via the /admin/index.php bigclass para…
• CVE-2018-18307A Stored XSS vulnerability has been discovered in version 4.…
• CVE-2018-18309An issue was discovered in the Binary File Descriptor (BFD) …
• CVE-2018-18310An invalid memory address dereference was discovered in dwfl…5.5
• CVE-2018-18311Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer ove…
• CVE-2018-18312Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer ove…
• CVE-2018-18313Perl before 5.26.3 has a buffer over-read via a crafted regu…
• CVE-2018-18314Perl before 5.26.3 has a buffer overflow via a crafted regul…