{"id":"CVE-2018-14840","aliases":["GHSA-vhqr-3gr2-7px9"],"url":"https://o3.security/vulnerability/CVE-2018-14840","summary":"Subrion CMS Cross-site Scripting","details":"uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).","published":"2018-08-02T01:29:03.107Z","modified":"2026-07-08T17:18:02.384696Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Packagist","name":"intelliants/subrion","fixedVersion":"4.2.2"}],"fix":{"url":"https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47","label":"intelliants/subrion@cb10ac2"},"references":[{"type":"ADVISORY","url":"https://github.com/intelliants/subrion/issues/773"},{"type":"FIX","url":"https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/45150/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T17:18:02.384696Z"}}