CVE-2018-13293 MEDIUM

CVE-2018-13293

Vendor Synology
Product DiskStation Manager (DSM)
Weakness CWE-79 · XSS
Published April 1, 2019
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.

Key dates

02Disclosure timeline

April 1, 2019 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-25173 WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability CVE-2024-54236 WordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-13159 Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload CVE-2024-2946 ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget CVE-2025-58990 WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability