PT-2026-44862 · Undefined · Undefined

Published 2026-05-29 · Updated 2026-05-29 · CVE-2018-25384

NVD

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-25384

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25384 · Security Note
• https://sourceforge.net/projects/wikidforum/files/Wikidforum-com-ed.2.20.zip/download · Note
• https://sourceforge.net/projects/wikidforum · Note
• https://vulncheck.com/advisories/wikidforum-cross-site-scripting-via-reply-text-parameter · Note
• https://exploit-db.com/exploits/45580 · Note