CVE-2018-1000526

7.5 highEPSS 2.1%

High (7.5) in openpsa2 openpsa. EPSS 2.1% chance of exploitation in the next 30 days.

Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-91
Published: 2018-06-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openpsa2:openpsa

References

https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/
https://github.com/flack/openpsa/issues/192
https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/
https://github.com/flack/openpsa/issues/192

Check your stack JSON