CVE-2018-25337
📛 CVE Title
(no title)
Description
Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML forms targeting account endpoints like /joomoc2/?route=account/edit and to modify user information or reset passwords without user consent.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- medium
- CVSS score
- 4.3 / 10
- CVSS vector
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N- Effective score
- 4.3 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2018-25337
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-17 13:16:45 UTC
- NVD last modified
- 2026-05-18 17:28:19 UTC
- NVD CVSS v3.1
- 4.3 / 10 MEDIUM source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 1.4 / 10
- EPSS score
- 0.0001 (probability of exploitation in next 30 days)
- EPSS percentile
- 0.31% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-352
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2018-21860 - Assigner
- VulnCheck
- Published
- May 17, 2026, 12:11:40 PM
- Updated
- May 18, 2026, 10:44:48 AM
- EUVD base score (CVSS 4.0)
-
5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L - EUVD-reported EPSS
- 0.0100
- Vendors
- Joomlaextensions
- Products
-
Joomla! extension JoomOCShop (1.0)
- Aliases
-
GHSA-cpjv-mhxq-9xqf
ENISA description: Joomla JoomOCShop 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML forms targeting account endpoints like /joomoc2/?route=account/edit and to modify user information or reset passwords without user consent.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (7)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/joomocshop/ tenable:extensions.joomla.org
- https://nvd.nist.gov/vuln/detail/CVE-2018-25337 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2018-25337 tenable:www.cve.org
- https://www.exploit-db.com/exploits/44789 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.joomlaextensions.co.in/ tenable:www.joomlaextensions.co.in
- https://www.vulncheck.com/advisories/joomla-joomocshop-cross-site-request-forgery tenable:www.vulncheck.com
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://extensions.joomla.org/extensions/extension/e-commerce/e-commerce-integrations/joomocshop/ disclosure@vulncheck.com
- https://www.exploit-db.com/exploits/44789 disclosure@vulncheck.com
- https://www.joomlaextensions.co.in/ disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/joomla-joomocshop-cross-site-request-forgery disclosure@vulncheck.com
Remediations (10)
-
web:cybersecuritynews.com
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.
2026-05-26 03:08 UTC -
web:github.com
A new and improved community patch for BO3. . Contribute to shiversoftdev/t7patch development by creating an account on GitHub.
2026-05-26 03:08 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-26 03:08 UTC -
web:support.esri.com
BUG-000153493 - Installing ArcGIS Server Security 2022 Update 1 Patch or Update 2 Patch on ArcGIS Server 10.8.1 affects the access to existing Workflow Manager (Classic) feature services. BUG-000153438 - ArcGIS Server services folders become inaccessible in the REST endpoint if it has a dot (.) in the name and the Security patches are installed.
2026-05-26 03:08 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-26 03:08 UTC -
web:www.lansweeper.com
Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday August 2025 summary.
2026-05-26 03:08 UTC -
web:www.manageengine.com
Patch Details: The name of the patch and the affected products. Patch Details The following patch details are shown: Patch ID: A unique reference ID for every patch Patch Name: The name of the patch Bulletin ID: The Bulletin ID pertaining to this patch MS Knowledge Base: The knowledge base article corresponding to this patch .
2026-05-26 03:08 UTC -
web:www.pcworld.com
This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.
2026-05-26 03:08 UTC -
web:www.watchguard.com
WatchGuard Patch Management is an add-on module that helps organizations identify, prioritize, and deploy security patches across operating systems and third-party applications. It supports Windows, macOS, and Linux workstations and servers, as well as hundreds of third-party applications, helping reduce the attack surface, improve patch consistency, and strengthen overall endpoint security.
2026-05-26 03:08 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 03:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.