{"id":"GHSA-x5jc-34xf-c24q","aliases":["CVE-2018-10366"],"title":"User Plugin for October CSS Allows XSS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.","severity":"medium","score":6.1,"published":"2022-05-14T03:21:09.000Z","modified":"2023-11-08T03:59:43.145Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"rainlab/user-plugin","sources":[{"name":"OSV · GHSA-x5jc-34xf-c24q","url":"https://osv.dev/vulnerability/GHSA-x5jc-34xf-c24q"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.5.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.5.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-10366","https://github.com/rainlab/user-plugin/commit/098c2bc907443d67e9e18645f850e3de42941d20","https://github.com/rainlab/user-plugin","https://www.exploit-db.com/exploits/44546"],"sources":[{"name":"OSV","id":"GHSA-x5jc-34xf-c24q","modified":"2023-11-08T03:59:43.145900Z","url":"https://osv.dev/vulnerability/GHSA-x5jc-34xf-c24q"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:30:33.923Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[{"source":"Exploit-DB","id":"44546","url":"https://www.exploit-db.com/exploits/44546","checkedAt":"2026-10-29T00:00:35.338Z"}]}