{"id":"CVE-2018-1000868","aliases":["EUVD-2018-2047","GHSA-v53j-5xg5-wr7x"],"status":"published","title":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in...","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0163,"percentile":0.76427,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-12-20T17:00:00Z","modified":"2026-10-20T10:49:40Z","products":[{"vendor":"webidsupport","product":"webid"}],"references":[{"url":"https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://bugs.webidsupport.com/view.php?id=648","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Release Notes","Vendor Advisory","report"]},{"url":"https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7f","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000868"},{"url":"https://github.com/advisories/GHSA-v53j-5xg5-wr7x"}],"sources":{"cve":[{"id":"CVE-2018-1000868","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2024-09-16T22:08:51.962Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-2047","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","status":"published","published":"2018-12-20T17:00:00Z","modified":"2024-09-16T22:08:51Z","updated_at":"2026-11-03T00:55:05.688542Z"}],"ghsa":[{"id":"GHSA-v53j-5xg5-wr7x","title":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in...","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","status":"published","published":"2022-05-14T01:42:29Z","modified":"2023-02-02T05:04:32Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:51:53.84386Z"}],"nvd":[{"id":"CVE-2018-1000868","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","status":"published","published":"2018-12-20T17:29:00.643Z","modified":"2026-06-17T01:33:12.88Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-1000868","description":"WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.","status":"published","published":"2018-12-20T17:29:00.643Z","modified":"2026-10-20T10:49:40.600366955Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"}]}}