CVE-2018-25350
The vulnerability in userSpice 4.3.24 lets anyone on the internet find real usernames by sending simple POST requests. An attacker can learn which accounts exist without needing to log in, which can aid further attacks.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
userSpice 4.3.24 (web application)
Real-world impact
An attacker can enumerate all valid usernames, enabling targeted phishing, password guessing, or social engineering attacks.
Why this severity
The CVSS score of 9.3 reflects that the flaw is easy to exploit, requires no authentication, and gives attackers high impact by revealing sensitive information that can be used in further attacks.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 23, 2026 · May 23, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.