CVE-2018-16638
Evolution CMS Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
- Record
CVE-2018-16638- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
- Record
CVE-2018-16638- Updated
- 2026-11-02
EUVDEUVD-2022-3414 No score
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
- Record
EUVD-2022-3414- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9mfc-gr8c-xj4m
Evolution CMS Cross-site Scripting (XSS)
Evolution CMS 1.4.x prior to 1.4.6 allows XSS via the manager/ search parameter.
- Record
GHSA-9mfc-gr8c-xj4m- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
- Record
CVE-2018-16638- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-9mfc-gr8c-xj4m
Evolution CMS Cross-site Scripting (XSS)
Evolution CMS 1.4.x prior to 1.4.6 allows XSS via the manager/ search parameter.
- Record
GHSA-9mfc-gr8c-xj4m- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
evolutioncms/evolutionPackagist |
1.4.0 up to 1.4.6 | 1.4.6 |
evolutioncms/evolutionPackagist |
1.4.0 up to 1.4.6, plus listed versions 1.4.21.4.31.4.41.4.5 |
1.4.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16638 is a medium vulnerability (CVSS 5.4) in Modx Evolution Cms, published December 28, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in evolutioncms/evolution 1.4.6.
References
github.com/security-breachlock/CVE-2018-16638/blob/master/evolution_xss_reflected.pdf
nvd.nist.gov/vuln/detail/CVE-2018-16638