{"id":"CVE-2018-5249","details":"Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field (aka the login parameter to the ban_canLogin function in index.php).","modified":"2026-10-20T10:51:29.040587492Z","published":"2018-01-05T20:29:00.220Z","database_specific":{},"references":[{"type":"ADVISORY","url":"https://github.com/shaarli/Shaarli/pull/1046"},{"type":"ADVISORY","url":"https://github.com/shaarli/Shaarli/releases/tag/v0.8.5"},{"type":"ADVISORY","url":"https://github.com/shaarli/Shaarli/releases/tag/v0.9.3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/shaarli/shaarli","events":[{"introduced":"0"},{"fixed":"9cd0df4d07599e8f0406c5cd867ebd01edc03846"},{"introduced":"54c8e8d2998c5ab5ffd08ae8f1fa11276773c16c"},{"fixed":"cb9b87eb1ca015b0fdb03a223e2df190cb53cf05"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"0.8.5"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:shaarli_project:shaarli:*:*:*:*:*:*:*:*","range":[{"introduced":"0.9.0"},{"fixed":"0.9.3"}]},{"range":[{"fixed":"9cd0df4d07599e8f0406c5cd867ebd01edc03846"}],"source":"REFERENCES_TAG","original_tag":"v0.8.5"},{"source":"REFERENCES_TAG","original_tag":"v0.9.3","range":[{"fixed":"cb9b87eb1ca015b0fdb03a223e2df190cb53cf05"}]}]}}],"versions":["v0.8.4","v0.9.2","v0.9.1","v0.9.0","v0.7.0","v0.8.3","v0.8.2","v0.8.0","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.5.4","v0.5.3","0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.0.45beta","v0.0.44beta","v0.0.43beta","v0.0.42beta","v0.0.41beta","v0.0.40beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-5249.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}