← Vulnerability feed

Vulnerability record · CVE-2018-18635 · published 24 October 2018

CVE-2018-18635: Mailcleaner cross-site scripting vulnerability

Mailcleaner · Mailcleaner

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.

6.1 CVSS 3.0 Medium EPSS 0.95% · top 40.4% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
0.95%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MailCleaner/MailCleaner/commit/5f90a52785672fc688c1f85e472e84b8a0d008d8 PatchThird Party Advisory
https://github.com/MailCleaner/MailCleaner/issues/53 ExploitPatchThird Party Advisory
https://github.com/MailCleaner/MailCleaner/commit/5f90a52785672fc688c1f85e472e84b8a0d008d8 PatchThird Party Advisory
https://github.com/MailCleaner/MailCleaner/issues/53 ExploitPatchThird Party Advisory

Track CVE-2018-18635 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-3191Mailcleaner os command injection vulnerabilityA vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the …EPSS 5.2%9.6CVE-2024-3192Mailcleaner cross-site scripting vulnerabilityA vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Adm…EPSS 1.00%8.8CVE-2024-3193Mailcleaner os command injection vulnerabilityA vulnerability has been found in MailCleaner up to 2023.03.14 and classified as critical. Affected by this vulnerability is an unknown functionality…EPSS 4.2%8.8CVE-2018-20323MailCleaner Community Edition Logs.php OS command injectionMailCleaner Community Edition 2018.08 contains an OS command injection flaw in www/soap/application/MCSoap/Logs.php. A remote attacker can inject com…EPSS 54%analysed7.5CVE-2019-1010246Mailcleaner missing authorization vulnerabilityMailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impac…EPSS 1.4%7.2CVE-2024-3195Mailcleaner path traversal vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14. It has been classified as critical. This affects an unknown part of the component Admin En…EPSS 0.95%6.7CVE-2024-3196Mailcleaner os command injection vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14. It has been declared as critical. This vulnerability affects the function getStats/Service…EPSS 1.7%6.1CVE-2024-3194Mailcleaner cross-site scripting vulnerabilityA vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the …EPSS 0.74%

Source: NIST National Vulnerability Database (record CVE-2018-18635), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.