PT-2026-44862
CVE-2018-25384
·
Published
2026-05-29
·
Updated
2026-10-06
Description by
CVSS 4.0
5.1
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Wikidforum version 2.20
Description
A cross-site scripting issue allows authenticated attackers to inject malicious scripts by submitting crafted HTML. This is achieved by sending JavaScript code through the 'rpc.php' endpoint using the
reply text parameter, which then executes in the browsers of other users viewing forum replies.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾