CVE-2018-5479

MEDIUM

FoxSash ImgHosting 1.5 - Cross-Site Scripting via Search Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-5479. PoCs published by Dennis Veninga.

AI-analyzed exploit summary This exploit demonstrates a Cross-Site Scripting (XSS) vulnerability in ImgHosting Image Storage System 1.5. The vulnerability is triggered via the search parameter, allowing arbitrary JavaScript execution when a victim visits a crafted URL.

Description

FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed.

Exploits (1)

exploitdb WORKING POC
by Dennis Veninga · textwebappsphp
https://www.exploit-db.com/exploits/43567

This exploit demonstrates a Cross-Site Scripting (XSS) vulnerability in ImgHosting Image Storage System 1.5. The vulnerability is triggered via the search parameter, allowing arbitrary JavaScript execution when a victim visits a crafted URL.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: ImgHosting Image Storage System 1.5
No auth needed
Prerequisites: Victim must visit a crafted URL
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43567/

Scores

CVSS v3 6.1
EPSS 0.0207
EPSS Percentile 79.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
foxsash/imghosting 1.5
Published Jan 15, 2018
Tracked Since Feb 18, 2026