CVE-2018-7465

An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.

• CWE-79

• http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handlingVendor Advisory
• https://imgur.com/a/Hf6JDExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44625/Exploit, Third Party Advisory, VDB Entry
• http://virtuemart.net/news/489-virtuemart-3-2-14-security-release-and-enhanced-invoice-handlingVendor Advisory
• https://imgur.com/a/Hf6JDExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44625/Exploit, Third Party Advisory, VDB Entry

Published

Apr 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7452A NULL pointer dereference in JPXStream::fillReadBuf in JPXS…
• CVE-2018-7453Infinite recursion in AcroForm::scanField in AcroForm.cc in …
• CVE-2018-7454A NULL pointer dereference in XFAForm::scanFields in XFAForm…
• CVE-2018-7455An out-of-bounds read in JPXStream::readTilePart in JPXStrea…
• CVE-2018-7456A NULL Pointer Dereference occurs in the function TIFFPrintD…
• CVE-2018-7463SQL injection vulnerability in files.php in the "files" comp…
• CVE-2018-7466install/installNewDB.php in TestLink through 1.9.16 allows r…
• CVE-2018-7467AxxonSoft Axxon Next has Directory Traversal via an initial …
• CVE-2018-7469PHP Scripts Mall Entrepreneur Job Portal Script 2.0.9 has XS…
• CVE-2018-7470An issue was discovered in ImageMagick 7.0.7-22 Q16. The IsW…
• CVE-2018-7471KingView 7.5SP1 has an integer overflow during stgopenstorag…
• CVE-2018-7472INVT Studio 1.2 allows remote attackers to cause a denial of…