CVE-2018-16249: b3log Symphony

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.

Affected products

• b3log Symphony: before 3.3.0 (fixed in 3.3.0)

Published 2019-06-20. Last modified 2026-06-17.