{"id":"GHSA-96mh-7xpr-qcgw","aliases":["CVE-2018-7198"],"title":"October CMS - RainLab Blog Plugin XSS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.","severity":"medium","score":6.1,"published":"2022-05-13T01:24:44.000Z","modified":"2024-02-21T05:35:47.655Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"rainlab/blog-plugin","sources":[{"name":"OSV · GHSA-96mh-7xpr-qcgw","url":"https://osv.dev/vulnerability/GHSA-96mh-7xpr-qcgw"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.4.1"}],"type":"ECOSYSTEM"}],"versions":["v1.3.1","v1.3.2","v1.3.4","v1.3.5","v1.3.6","v1.4.0"],"fixed":["1.4.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-7198","https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94","https://github.com/rainlab/blog-plugin","https://www.exploit-db.com/exploits/44144","http://securitywarrior9.blogspot.com/2018/02/html-injection-october-cms.html"],"sources":[{"name":"OSV","id":"GHSA-96mh-7xpr-qcgw","modified":"2024-02-21T05:35:47.655534Z","url":"https://osv.dev/vulnerability/GHSA-96mh-7xpr-qcgw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T14:50:32.401Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"44144","url":"https://www.exploit-db.com/exploits/44144","checkedAt":"2026-10-28T07:55:38.811Z"}]}