Read the docs

UserSpice

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

UserSpice records in CISA KEV

No UserSpice vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2018-15575 CVE-2018-25350 · GHSA-56j3-w2r5-qgxq

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

Priority HIGH 81

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00433 Published 2026-05-23 No fix listed CWE-204
TI-2018-15574 CVE-2018-25349 · GHSA-7m67-452p-94vw

userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header

Priority MEDIUM 56

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00155 Published 2026-05-23 No fix listed CWE-79
Open these records in search →