VYPR
← All advisories
Medium severity6.1OSV Advisory· Published Apr 5, 2018· Updated Jun 17, 2026

CVE-2018-1000154

CVE-2018-1000154

Description

Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject of emails which are not html quoted in certain cases. This can result in the embedding and execution of java script code on users browser. This attack appear to be exploitable via the victim openning a ticket. This vulnerability appears to have been fixed in 2.3.1, 2.2.2 and 2.1.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Zammad/ZammadOSV2 versions
    1.0.0, 1.1.0, 1.4.0, …+ 1 more
    • (no CPE)range: 1.0.0, 1.1.0, 1.4.0, …
    • (no CPE)range: <=2.3.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.