PT-2026-43061 · Userspice · Userspice

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions userSpice version 4.3.24

Description An issue allows unauthenticated attackers to discover valid usernames by sending POST requests to the 'existingUsernameCheck.php' endpoint. By submitting usernames and analyzing the response text for the 'taken' string, attackers can identify existing accounts in the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2018-25350

Affected Products

Userspice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25350 · Security Note
• https://t.me/CVEtracker/54727 · Telegram Post
• https://vulncheck.com/advisories/userspice-username-enumeration-via-existingusernamecheck-php · Note
• https://exploit-db.com/exploits/44872 · Note