How severe is CVE-2018-20634?

CVE-2018-20634 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2018-20634 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-20634?

CVE-2018-20634 affects Advance B2b Script Project Advance B2b Script. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-20634?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-20634 published?

CVE-2018-20634 was published on 2019-03-21 and last updated on 2026-06-17.

CVE-2018-20634

CVE-2018-20634 is a medium-severity vulnerability in Advance B2b Script Project Advance B2b Script with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-119
Affected product: Advance B2b Script Project Advance B2b Script
Published: 2019-03-21
Last modified: 2026-06-17

Description

PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name field.

Frequently asked questions

What is CVE-2018-20634?: PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name field.
How severe is CVE-2018-20634?: CVE-2018-20634 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2018-20634 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-20634?: CVE-2018-20634 affects Advance B2b Script Project Advance B2b Script. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-20634?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-20634 published?: CVE-2018-20634 was published on 2019-03-21 and last updated on 2026-06-17.

References

https://gkaim.com/cve-2018-20634-vikas-chaudhary/

Affected products (1)

cpe:2.3:a:advance_b2b_script_project:advance_b2b_script:2.1.4:*:*:*:*:*:*:*

More vulnerabilities in Advance B2b Script Project Advance B2b Script

CVE-2017-17602 — Critical (CVSS 9.8): Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
CVE-2018-20633 — High (CVSS 8.8): PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
CVE-2018-20632 — Medium (CVSS 5.4): PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.
CVE-2018-20635 — Medium (CVSS 4.3): PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image…

All CVEs affecting Advance B2b Script Project Advance B2b Script →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →