GCVE - cpe:2.3:a:btiteam:xbtit:2.5.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:btiteam:xbtit:2.5.4:*:*:*:*:*:*:*

part: a version: 2.5.4 update: *

Vendor	Btiteam (`c4dedd63-cb97-5655-8296-97d20c1ee594`)
Product	Xbtit (`e4867079-6d40-500a-90c9-6091000ab2e1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/btiteam/xbtit-3.1`	purl2cpe	2026-06-01 10:14:47.575723

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-16361`	vulnerable	2026-06-08 05:11:04.751102	Details available An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:24:32.079Z Open on db.gcve.eu Reference links https://github.com/btiteam/xbtit/pull/58 https://rastating.github.io/xbtit-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15681`	vulnerable	2026-06-08 05:10:55.254112	Details available An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:01:54.118Z Open on db.gcve.eu Reference links https://rastating.github.io/xbtit-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15680`	vulnerable	2026-06-08 05:10:55.253807	Details available An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:01:54.253Z Open on db.gcve.eu Reference links https://rastating.github.io/xbtit-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15679`	vulnerable	2026-06-08 05:10:55.253405	Details available An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:01:54.246Z Open on db.gcve.eu Reference links https://github.com/btiteam/xbtit/pull/58 https://rastating.github.io/xbtit-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15678`	vulnerable	2026-06-08 05:10:55.253071	Details available An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting. Published: 2018-09-05T21:00:00.000Z Updated: 2024-08-05T10:01:54.495Z Open on db.gcve.eu Reference links https://github.com/btiteam/xbtit/pull/58 https://rastating.github.io/xbtit-multiple-vulnerabilities/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-15677`	vulnerable	2026-06-08 05:10:55.252662	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.