CVE-2018-9999

—

CVSS 3.0

5.4 medium

EPSS

<1%p53

Published

Apr 18, 2018 (Apr 18, 2018)

Modified

Jun 17, 2026

Description

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend.

Vendors: zulip
Products: zulip server
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news1 stories

OpIran:Anonymous declares war on Iran amid Mahsa Amini’s death

Security AffairsSep 25, 12:08 UTC · Sep 25, 2022Data breach CVE-2018-9999

50