CVE-2018-18361

Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10

Description An issue was discovered that allows XSS via the name parameter in the "index.php?action=edit html" endpoint. This is demonstrated by a value beginning with 'home content' and containing a crafted SRC attribute of an IMG element.

Recommendations For versions prior to 2017-03-10, avoid using the name parameter in the "index.php?action=edit html" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.