Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: UserSpice Clear all filters
TI-2018-15575 CVE-2018-25350 · GHSA-56j3-w2r5-qgxq

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

Priority HIGH 81

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00433 Published 2026-05-23 No fix listed CWE-204
TI-2018-15574 CVE-2018-25349 · GHSA-7m67-452p-94vw

userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header

Priority MEDIUM 56

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00155 Published 2026-05-23 No fix listed CWE-79