CVE-2019-18873
CVSS v3
9
CRITICAL
EPSS Score
8.2 %
exploit probability, as of 2026-10-04
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.
Technical details
- Published
- 2019-11-12
- Exploit-DB
- EDB-47650
Frequently asked questions
What is CVE-2019-18873?
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.
Is CVE-2019-18873 actively exploited?
Active exploitation of CVE-2019-18873 has not been confirmed. Its EPSS score was 8.2% on 2026-10-04, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2019-18873?
CVE-2019-18873 has a CVSS v3 base score of 9 (CRITICAL severity).
Is CVE-2019-18873 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2019 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).