Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2018-12095: OEcms v3.1 can let attackers run malicious scripts
CVE-2018-12095 · published 8 years ago
Summary
The OEcms version 3.1 web application does not properly check data sent to the info.php page, so an attacker could trick a user into clicking a crafted link and have unwanted code run in their browser. This could lead to stolen login details or other sensitive information. Update to the latest OEcms release or apply the vendor's security patch that sanitizes the input.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| oecms_project | oecms |
3.1 cpe:2.3:a:oecms_project:oecms:3.1:*:*:*:*:*:*:* |
Original advisory text
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
References
- https://cxsecurity.com/issue/WLB-2018060092 Exploit Third Party Advisory
- https://www.exploit-db.com/exploits/44895/ Exploit Third Party Advisory VDB Entry
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Jun 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-12095 · NVD
Track software like this
Free during beta