CVE-2018-25350 - userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

Back Back to CVE browser

CRITICAL

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

Published May 23, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.43%

Description

userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by sending POST requests to the existingUsernameCheck.php endpoint. Attackers can submit usernames and analyze response text for the 'taken' string to identify existing accounts in the system.

Affected products

Vendor UserSpice Product userSpice Default
n/a
- Version
  4.3.24
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

UserSpice

userSpice

n/a

Version	Status	Constraints
4.3.24	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-204

References (2)

https://www.exploit-db.com/exploits/44872
exploit
https://www.vulncheck.com/advisories/userspice-username-enumeration-via-existingusernamecheck-php
third-party-advisory

Link	Providers	Tags
https://www.exploit-db.com/exploits/44872		exploit
https://www.vulncheck.com/advisories/userspice-username-enumeration-via-existingusernamecheck-php		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulnCheck

Published May 23, 2026

Updated May 26, 2026

Reserved May 23, 2026

Link CVE-2018-25350

CISA Vulnrichment

Updated May 26, 2026

NVD

Status Deferred

Modified Jul 23, 2026

Link CVE-2018-25350

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-25350