CVE-2018-11351

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-07 · updated 2026-06-17
Weakness: CWE-79

Description

script.php in Jirafeau before 3.4.1 is affected by two stored Cross-Site Scripting (XSS) vulnerabilities. These are stored within the shared files description file and allow the execution of a JavaScript payload each time an administrator searches or lists uploaded files. These two injections could be triggered without authentication, and target the administrator. The attack vectors are the Content-Type field and the filename parameter.

Affected products

Jirafeau project Jirafeau: before 3.4.1 — fixed in 3.4.1

How to fix

Upgrade to a fixed version: Jirafeau project Jirafeau 3.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11351 or the next vulnerability affects your stack