What is GHSA-q3m7-9pg6-jjh6?

GHSA-q3m7-9pg6-jjh6 is a security advisory published by GitHub Security Advisories with Medium severity. Zenar Content Management System contains a cross-site scripting vulnerability that allows...

Which CVE IDs does GHSA-q3m7-9pg6-jjh6 cover?

GHSA-q3m7-9pg6-jjh6 covers the following CVE IDs: CVE-2018-25331. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q3m7-9pg6-jjh6?

GHSA-q3m7-9pg6-jjh6 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-q3m7-9pg6-jjh6MediumCVSS 6.1

Zenar Content Management System contains a cross-site scripting vulnerability that allows...

Vendor

GitHub Security Advisories

Published

May 17, 2026

Last Modified

May 17, 2026

🔗 CVE IDs covered (1)

CVE-2018-25331 →

📋 Description

Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating form parameters in POST requests. Attackers can inject script tags through the current_page parameter sent to the ajax.php endpoint, which reflects unsanitized user input in the response HTML to execute arbitrary JavaScript in victim browsers.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-25331
https://www.exploit-db.com/exploits/44664
https://www.vulncheck.com/advisories/zenar-content-management-system-cross-site-scripting-via-ajax-php
https://zenar.io
http://demo.zenar.io
https://github.com/advisories/GHSA-q3m7-9pg6-jjh6