CVE-2018-17361: Weaselcms Project Weaselcms

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.

Affected products

• Weaselcms Project Weaselcms: version 0.3.6 only

Published 2018-09-23. Last modified 2026-06-17.