CVE-2018-1000526

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-26 · updated 2026-06-17
Weakness: CWE-91

Description

Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.

Affected products

Openpsa2 Openpsa: all versions

References

https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/
https://github.com/flack/openpsa/issues/192
https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/
https://github.com/flack/openpsa/issues/192

Get alerted when CVE-2018-1000526 or the next vulnerability affects your stack