CVE-2018-25350CWE-204

CVE-2018-25350

Critical · published May 23, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-05-23T23:16Z
References (2)
https://www.exploit-db.com/exploits/44872 · [email protected]https://www.vulncheck.com/advisories/userspice-username-enumeration-via-existingusernamecheck-php · [email protected]
EPSS history
Timeline
  • 23 MAY 18:30Z
    userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php
    cvelistv5