CVE-2018-14840
Subrion CMS Cross-site Scripting
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
CVE-2018-14840- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
CVE-2018-14840- Updated
- 2026-11-02
EUVDEUVD-2022-5361 No score
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
EUVD-2022-5361- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vhqr-3gr2-7px9
Subrion CMS Cross-site Scripting
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
GHSA-vhqr-3gr2-7px9- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
CVE-2018-14840- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vhqr-3gr2-7px9
Subrion CMS Cross-site Scripting
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
- Record
GHSA-vhqr-3gr2-7px9- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
intelliants/subrionPackagist |
before 4.2.2 | 4.2.2 |
intelliants/subrionPackagist |
before 4.2.2, plus listed versions v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4 Show 9 moreShow lessv4.0.5v4.1.0v4.1.1v4.1.2v4.1.3v4.1.4v4.1.5v4.2.0v4.2.1 |
4.2.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Subrion CMS 4.2.1 - Cross-Site Scripting | 2018-08-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14840 is a medium vulnerability (CVSS 6.1) in Intelliants Subrion, published August 2, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.67%, the 89th percentile. Fixed in intelliants/subrion 4.2.2.
References
github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47
exploit-db.com/exploits/45150
nvd.nist.gov/vuln/detail/CVE-2018-14840