{"api_version":"1","generated_at":"2026-07-23T11:18:01+00:00","cve":"CVE-2018-1000526","urls":{"html":"https://cve.report/CVE-2018-1000526","api":"https://cve.report/api/cve/CVE-2018-1000526.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1000526","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000526"},"summary":{"title":"CVE-2018-1000526","description":"Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-06-26 16:29:00","updated_at":"2018-08-30 15:15:00"},"problem_types":["CWE-91"],"metrics":[],"references":[{"url":"https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/","name":"https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/","refsource":"MISC","tags":["Third Party Advisory"],"title":"OpenPSA PHP Objection Injection | 0dd - The Zero (0) Day Division","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://github.com/flack/openpsa/issues/192","name":"https://github.com/flack/openpsa/issues/192","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"XML DoS Attack · Issue #192 · flack/openpsa · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000526","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000526","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1000526","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openpsa2","cpe5":"openpsa","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1000526","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openpsa2","cpe5":"openpsa","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","DATE_ASSIGNED":"2018-06-23T11:22:33.036331","DATE_REQUESTED":"2018-06-01T15:33:50","ID":"CVE-2018-1000526","REQUESTER":"sajeeb@0dd.zone","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/","refsource":"MISC","url":"https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/"},{"name":"https://github.com/flack/openpsa/issues/192","refsource":"MISC","url":"https://github.com/flack/openpsa/issues/192"}]}},"nvd":{"publishedDate":"2018-06-26 16:29:00","lastModifiedDate":"2018-08-30 15:15:00","problem_types":["CWE-91"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openpsa2:openpsa:-:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1000526","Ordinal":"129246","Title":"CVE-2018-1000526","CVE":"CVE-2018-1000526","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1000526","Ordinal":"1","NoteData":"Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in after commit 4974a26.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1000526","Ordinal":"2","NoteData":"2018-06-26","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1000526","Ordinal":"3","NoteData":"2018-06-26","Type":"Other","Title":"Modified"}]}}}