CVE-2018-25056 is a Cross-Site Scripting (XSS) vulnerability found in the yolapi component of the yola product. Specifically, the render_description function in yolapi/pypi/metadata.py is susceptible to manipulation of the 'text' argument, allowing for remote XSS attacks. The vulnerability has a CVSS v3.1 score of 6.1 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. Its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. There is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received no significant community discussion or media coverage, further indicating a low level of attention and perceived threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:yola:yolapi:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.