CVE-2018-25116
Last modified
CVE-2018-25116 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that will execute when other users view the thread, allowing arbitrary script execution.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that will execute when other users view the thread, allowing arbitrary script execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mybb | Thread Redirect | 0.2.1 |
References
- https://www.exploit-db.com/exploits/49505Exploit, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2018-25116?
How severe is CVE-2018-25116?
How do I fix CVE-2018-25116?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-25110Marked prior to version 0.3.17 is vulnerable to a Regular Ex…7.5
- CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure …4.4
- CVE-2018-25112An unauthenticated remote attacker may use an uncontrolled r…7.5
- CVE-2018-25113An unauthenticated path traversal vulnerability exists in Di…8.7
- CVE-2018-25114A remote code execution vulnerability exists within osCommer…9.3
- CVE-2018-25115Multiple D-Link DIR-series routers, including DIR-110, DIR-4…9.8
- CVE-2018-25117VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (20…9.3
- CVE-2018-25118GeoVision embedded IP devices, confirmed on GV-BX1500 and GV…10
- CVE-2018-25119Nagios Fusion versions prior to 4.1.5 are vulnerable to cros…6.1
- CVE-2018-25120D-Link DNS-343 ShareCenter devices running firmware versions…9.8
- CVE-2018-25121Nagios XI versions prior to 5.4.13 are vulnerable to cross-s…5.4
- CVE-2018-25122Nagios XI versions prior to 5.4.13 contain a remote code exe…8.8
Are you affected by CVE-2018-25116?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST