What’s Vulnerable › Vulnerabilities

CVE-2018-25350: userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-23 · updated 2026-10-06
• Weakness: CWE-204

Description

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.

Affected products

• userSpice: 4.3.24

References

• https://www.exploit-db.com/exploits/44872
• https://www.vulncheck.com/advisories/userspice-username-enumeration-via-existingusernamecheck-php

Get alerted when CVE-2018-25350 or the next vulnerability affects your stack