CVE-2018-16637
Evolution CMS Stored Cross-site Scripting (XSS)
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
- Record
CVE-2018-16637- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
- Record
CVE-2018-16637- Updated
- 2026-11-02
EUVDEUVD-2022-3180 No score
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
- Record
EUVD-2022-3180- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8h24-3cjr-xxmh
Evolution CMS Stored Cross-site Scripting (XSS)
Evolution CMS 1.4.x prior to 1.4.6 allows XSS via the page weblink title parameter to the manager/ URI.
- Record
GHSA-8h24-3cjr-xxmh- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
- Record
CVE-2018-16637- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-8h24-3cjr-xxmh
Evolution CMS Stored Cross-site Scripting (XSS)
Evolution CMS 1.4.x prior to 1.4.6 allows XSS via the page weblink title parameter to the manager/ URI.
- Record
GHSA-8h24-3cjr-xxmh- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
evolutioncms/evolutionPackagist |
1.4 up to 1.4.6 | 1.4.6 |
evolutioncms/evolutionPackagist |
1.4 up to 1.4.6, plus listed versions 1.4.21.4.31.4.41.4.5 |
1.4.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16637 is a medium vulnerability (CVSS 5.4) in Modx Evolution Cms, published December 28, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in evolutioncms/evolution 1.4.6.
References
github.com/security-breachlock/CVE-2018-16637/blob/master/evolution_xss_stored.pdf
nvd.nist.gov/vuln/detail/CVE-2018-16637