CVE-2018-18982

high · 8.8

NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.

8.8

CVSS

60.8%

EPSS (exploit prob.)

99th

EPSS percentile

2018-11-27

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
nuuo	nuuo_cms	<= 3.3

Check a specific version with /api/v1/cve/match.

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
https://www.exploit-db.com/exploits/46449/
https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
https://www.exploit-db.com/exploits/46449/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-18982