CVE-2018-25349

Name of the Vulnerable Software and Affected Versions userSpice version 4.3.24

Description Cross-site scripting allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. By sending crafted requests to the 'backup.php' endpoint containing XSS payloads in the X-Forwarded-For header, the scripts are executed when administrators access the audit log page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.