CVE-2018-16629
Subrion CMS XSS
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
CVE-2018-16629- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
CVE-2018-16629- Updated
- 2026-11-02
EUVDEUVD-2022-4653 No score
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
EUVD-2022-4653- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mxv3-qcmf-r6wj
Subrion CMS XSS
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
GHSA-mxv3-qcmf-r6wj- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
CVE-2018-16629- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-mxv3-qcmf-r6wj
Subrion CMS XSS
panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
- Record
GHSA-mxv3-qcmf-r6wj- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
intelliants/subrionPackagist |
through 4.2.1 | None known |
intelliants/subrionPackagist |
through 4.2.1, plus listed versions v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4 Show 9 moreShow lessv4.0.5v4.1.0v4.1.1v4.1.2v4.1.3v4.1.4v4.1.5v4.2.0v4.2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16629 is a medium vulnerability (CVSS 4.8) in Intelliants Subrion Cms, published December 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. No source names a fixed version.
References
github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf
nvd.nist.gov/vuln/detail/CVE-2018-16629