CVE-2018-18678

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-30 · updated 2026-06-17
Weakness: CWE-79

Description

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the adm/boardgroup_form_update.php gr_1~10 parameter.

Affected products

gnuboard5: before 5.3.2.0 — fixed in 5.3.2.0

How to fix

Upgrade to a fixed version: gnuboard5 5.3.2.0. Check the vendor advisory for mitigations.

References

https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d87f2c71fb4fe131465ba1ff0a5d573d
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0
https://github.com/gnuboard/gnuboard5/commit/a45241f4bc46aee1ab2cc0749f6444b043681edf#diff-d87f2c71fb4fe131465ba1ff0a5d573d
https://github.com/gnuboard/gnuboard5/compare/15b2e73...2549172
https://github.com/gnuboard/gnuboard5/releases/tag/5.3.2.0

Get alerted when CVE-2018-18678 or the next vulnerability affects your stack