What’s Vulnerable › Vulnerabilities

CVE-2018-10364

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-30 · updated 2026-06-17
• Weakness: CWE-79

Description

BigTree before 4.2.22 has XSS in the Users management page via the name or company field.

Affected products

• Bigtreecms Bigtree Cms: before 4.2.22 — fixed in 4.2.22

How to fix

Upgrade to a fixed version: Bigtreecms Bigtree Cms 4.2.22. Check the vendor advisory for mitigations.

References

• https://github.com/bigtreecms/BigTree-CMS#changelog
• https://github.com/bigtreecms/BigTree-CMS/commit/b2eff67e45b90ca26a62e971e8f0d5d0d70f23e6
• https://github.com/bigtreecms/BigTree-CMS/issues/332
• https://github.com/bigtreecms/BigTree-CMS#changelog
• https://github.com/bigtreecms/BigTree-CMS/commit/b2eff67e45b90ca26a62e971e8f0d5d0d70f23e6
• https://github.com/bigtreecms/BigTree-CMS/issues/332

Get alerted when CVE-2018-10364 or the next vulnerability affects your stack