Medium severity4.8NVD Advisory· Published Jun 20, 2019· Updated Jun 17, 2026
CVE-2018-16249
CVE-2018-16249
Description
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
Affected products
1- Symphony/Symphonydescription
Patches
Vulnerability mechanics
References
1- github.com/b3log/symphony/issues/729nvdExploitIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.