CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2018-25350 — userSpice 4.3.24 contains a username enumeration vulnerability that allows unaut...

·Source: NIST NVD

Updated:

Executive Summary

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.

Analysis

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system. CVSS Score: 9.8. Published: 2026-05-23T19:16:55.120.

Indicators of Compromise (1)

CVE (1)
CVE-2018-25350
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 23, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

Oracle’s First Monthly Patches Resolve 77 Vulnerabilities

Oracle’s monthly Critical Security Patch Update (CSPU) rollouts are meant to deliver critical fixes faster. The post Oracle’s First Monthly Patches Resolve 77 Vulnerabilities appeared first on SecurityWeek .

SecurityWeek
LOWVulnerability

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded

Password manager Dashlane has disclosed that "fewer than" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an "external" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

The Hacker News
MEDIUMVulnerability

Alberto Daniel Hill’s Cybermidnight Coverage of the Latin American Digital Sovereignty Crisis (March–June 2026)

Alberto Daniel Hill’s report is a must-read for anyone who wants to begin to understand what is going on in Argentina, Uruguay, and Mexico with respect to digital security. One of the many limitations of being a solo blogger is that there are entire areas of the world or sectors I basically know nothing about... Source

DataBreaches.net