Security readout for executives and security teams
Plain-English summary
CVE-2018-11735 is a cross-site scripting issue reported in Ximdex 4.0 account creation. A crafted first name or surname value could cause script execution in a user's browser. The public record does not provide CVSS, confirmed fix details, or evidence of active exploitation.
Executive priority
Prioritize if Ximdex 4.0 registration is internet-facing or used by privileged staff. Otherwise handle through normal web application remediation tracking.
Technical view
The CVE describes XSS in `index.php?action=createaccount` through the `sname` or `fname` parameter in Ximdex 4.0. Source detail is sparse: no CWE, CVSS vector, affected CPEs, or patch version is listed in the provided CVE bundle.
Likely exposure
Exposure is most likely where Ximdex 4.0 account creation is reachable, especially on internet-facing sites with self-registration enabled. Evidence for other versions is not provided.
Exploitation context
The source bundle does not show KEV listing or cited evidence of exploitation in the wild. Treat exploit status as unconfirmed.
Researcher notes
The CVE record names only Ximdex 4.0 and two parameters. Missing CVSS, CWE, CPE, patch, and exploit details limit precision. Do not assume broader version impact without vendor or maintainer evidence.
Mitigation direction
- Confirm whether any deployed Ximdex instance is version 4.0.
- Review the linked Ximdex issue and current vendor guidance for fixes.
- Restrict public access to account creation until remediation is confirmed.
- If supported, upgrade to a vendor-recommended fixed release.
- Monitor logs for suspicious account creation parameter values.
Validation and detection
- Inventory Ximdex deployments and confirm exposed versions.
- Check whether `index.php?action=createaccount` is reachable externally.
- Use approved application security testing to validate XSS safely.
- Review templates or handlers processing `fname` and `sname` for unsafe output.
- Document whether vendor remediation or compensating controls are present.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-11735 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/XIMDEX/ximdex/issues/146CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.