PT-2026-44862 · Undefined · Undefined

CVE-2018-25384 · Published 2026-05-29 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Wikidforum version 2.20

Description A cross-site scripting issue allows authenticated attackers to inject malicious scripts by submitting crafted HTML. This is achieved by sending JavaScript code through the 'rpc.php' endpoint using the reply text parameter, which then executes in the browsers of other users viewing forum replies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-25384

Affected Products

Undefined

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-25384 · Security Note
• https://t.me/cveNotify/166766 · Telegram Post
• https://sourceforge.net/projects/wikidforum · Note
• https://sourceforge.net/projects/wikidforum/files/Wikidforum-com-ed.2.20.zip/download · Note
• https://t.me/cveNotify/165900 · Telegram Post
• https://exploit-db.com/exploits/45580 · Note
• https://vulncheck.com/advisories/wikidforum-cross-site-scripting-via-reply-text-parameter · Note