Medium severity · published Feb 21, 2018
CVE-2018-7261
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
Radiant Cms · Radiantcms
1.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7261
Third Party Advisory
http://www.securityfocus.com/archive/1/541798/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/103080
More from Radiant Cms
5.4
CVE-2018-5216
Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource