CVE-2018-16725

MEDIUM

baijiacms V4 - Cross-Site Scripting via ZeroClipboard.swf id Parameter

Title source: llm

Description

An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/xxy961216/attack-baijiacmsV4-with-xss

View Exploit ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0071

EPSS Percentile 48.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

baijiacms_project/baijiacms 4.0

Published Sep 08, 2018

Tracked Since Feb 18, 2026