CVE-2018-18982

high-risk
Published 2018-11-27

NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.

Do I need to act?

!
66.8% chance of exploitation in next 30 days
EPSS score — higher than 33% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
46449
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Nuuo

References (4)

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
Exploit https://www.exploit-db.com/exploits/46449/
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
Exploit https://www.exploit-db.com/exploits/46449/
61
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 26/34 · High
Exposure 5/34 · Minimal