2018 CVEs (page 3)
Page 3 of 179 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-25236 | Critical | 9.8 | 2026-04-03 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) m… |
CVE-2018-25237 | Critical | 9.8 | 2026-04-03 | Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled… |
CVE-2018-25235 | Medium | 6.2 | 2026-03-30 | NetworkActiv Web Server 4.0 contains a buffer overflow vulnerability in the username field of the Security options that allows local attackers to crash the app… |
CVE-2018-25234 | Medium | 6.2 | 2026-03-30 | SmartFTP Client 9.0.2615.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long str… |
CVE-2018-25233 | Medium | 6.2 | 2026-03-30 | WebDrive 18.00.5057 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in… |
CVE-2018-25232 | Medium | 5.5 | 2026-03-30 | Softros LAN Messenger 9.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long stri… |
CVE-2018-25231 | Medium | 6.2 | 2026-03-30 | HeidiSQL 9.5.0.5196 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long file path… |
CVE-2018-25230 | Medium | 5.5 | 2026-03-30 | Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in t… |
CVE-2018-25229 | Medium | 5.5 | 2026-03-30 | BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the SMTP configuration interface that allows local attackers to crash the appl… |
CVE-2018-25228 | Medium | 6.2 | 2026-03-30 | NetSetMan 4.7.1 contains a buffer overflow vulnerability in the Workgroup feature that allows local attackers to crash the application by supplying oversized i… |
CVE-2018-25227 | Medium | 6.2 | 2026-03-30 | Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string… |
CVE-2018-25226 | Medium | 6.2 | 2026-03-30 | FTPShell Server 6.83 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in t… |
CVE-2018-25225 | High | 8.4 | 2026-03-28 | SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious inpu… |
CVE-2018-25224 | High | 8.4 | 2026-03-28 | PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious valu… |
CVE-2018-25223 | Critical | 9.8 | 2026-03-28 | Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the app… |
CVE-2018-25222 | High | 8.4 | 2026-03-28 | SC v7.16 contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying oversized input that exceeds b… |
CVE-2018-25221 | Critical | 9.8 | 2026-03-28 | EChat Server 3.1 contains a buffer overflow vulnerability in the chat.ghp endpoint that allows remote attackers to execute arbitrary code by supplying an overs… |
CVE-2018-25220 | Critical | 9.8 | 2026-03-28 | Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by supplying an oversized input string to the… |
CVE-2018-25219 | High | 8.4 | 2026-03-26 | PassFab Excel Password Recovery 8.3.1 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary c… |
CVE-2018-25218 | High | 8.4 | 2026-03-26 | PassFab RAR Password Recovery 9.3.2 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrar… |
CVE-2018-25217 | High | 8.4 | 2026-03-26 | PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting… |
CVE-2018-25216 | Medium | 6.2 | 2026-03-26 | AnyBurn 4.3 contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the… |
CVE-2018-25215 | Medium | 5.5 | 2026-03-26 | Excel Password Recovery Professional 8.2.0.0 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an… |
CVE-2018-25214 | Medium | 6.2 | 2026-03-26 | MegaPing contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload to the Destinati… |
CVE-2018-25213 | High | 8.4 | 2026-03-26 | Nsauditor 3.0.28.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying ma… |
CVE-2018-25212 | High | 8.4 | 2026-03-26 | Boxoft wav-wma Converter 1.0 contains a local buffer overflow vulnerability in structured exception handling that allows attackers to execute arbitrary code by… |
CVE-2018-25211 | High | 7.8 | 2026-03-26 | Allok Video Splitter 3.1.1217 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service or execute arbitrary code by su… |
CVE-2018-25210 | High | 8.2 | 2026-03-26 | WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate… |
CVE-2018-25209 | High | 8.2 | 2026-03-26 | OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through t… |
CVE-2018-25208 | High | 8.2 | 2026-03-26 | qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by… |
CVE-2018-25207 | High | 7.1 | 2026-03-26 | Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL comm… |
CVE-2018-25206 | High | 8.2 | 2026-03-26 | KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attack… |
CVE-2018-25205 | High | 8.2 | 2026-03-26 | ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in th… |
CVE-2018-25204 | High | 8.2 | 2026-03-26 | Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the userna… |
CVE-2018-25203 | High | 8.2 | 2026-03-26 | Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2018-25202 | High | 8.2 | 2026-03-26 | SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in t… |
CVE-2018-25201 | High | 7.1 | 2026-03-26 | School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by inj… |
CVE-2018-25195 | High | 8.2 | 2026-03-26 | Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication b… |
CVE-2018-25185 | High | 8.2 | 2026-03-26 | Wecodex Restaurant CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2018-25183 | High | 8.2 | 2026-03-26 | Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through th… |
CVE-2018-25159 | Critical | 9.8 | 2026-03-11 | Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to… |
CVE-2018-25200 | Medium | 5.3 | 2026-03-06 | OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting m… |
CVE-2018-25199 | High | 8.2 | 2026-03-06 | OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25198 | Medium | 6.2 | 2026-03-06 | eToolz 3.4.8.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying oversized input buffers. Attackers… |
CVE-2018-25197 | High | 8.2 | 2026-03-06 | PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2018-25196 | High | 8.2 | 2026-03-06 | ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2018-25194 | High | 8.2 | 2026-03-06 | Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25193 | High | 7.5 | 2026-03-06 | Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connection… |
CVE-2018-25192 | High | 8.2 | 2026-03-06 | GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through t… |
CVE-2018-25191 | High | 7.1 | 2026-03-06 | Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25190 | Medium | 5.3 | 2026-03-06 | Easyndexer 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative accounts by submitting forged… |
CVE-2018-25189 | High | 8.2 | 2026-03-06 | Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arb… |
CVE-2018-25188 | High | 8.2 | 2026-03-06 | Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious co… |
CVE-2018-25187 | High | 8.2 | 2026-03-06 | Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. At… |
CVE-2018-25186 | Medium | 5.3 | 2026-03-06 | Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests… |
CVE-2018-25184 | Medium | 6.2 | 2026-03-06 | Surreal ToDo 0.6.1.2 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the content pa… |
CVE-2018-25182 | High | 8.2 | 2026-03-06 | Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2018-25181 | High | 7.5 | 2026-03-06 | Musicco 2.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary directories by manipulating the parent parame… |
CVE-2018-25180 | High | 7.1 | 2026-03-06 | Maitra 1.7.2 contains an sql injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2018-25179 | High | 8.2 | 2026-03-06 | Gumbo CMS 0.99 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25178 | High | 7.5 | 2026-03-06 | Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file par… |
CVE-2018-25177 | Medium | 5.3 | 2026-03-06 | Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by su… |
CVE-2018-25176 | High | 8.2 | 2026-03-06 | Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t… |
CVE-2018-25175 | High | 8.2 | 2026-03-06 | Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2018-25174 | Medium | 5.3 | 2026-03-06 | ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credentials by submitting forged requests to _c… |
CVE-2018-25173 | High | 8.2 | 2026-03-06 | Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the… |
CVE-2018-25172 | High | 8.2 | 2026-03-06 | Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25171 | High | 8.2 | 2026-03-06 | EdTv 2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the '… |
CVE-2018-25170 | High | 8.2 | 2026-03-06 | DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id… |
CVE-2018-25169 | High | 7.5 | 2026-03-06 | AMPPS 2.7 contains a denial of service vulnerability that allows remote attackers to crash the service by sending malformed data to the default HTTP port. Atta… |
CVE-2018-25168 | Medium | 4.3 | 2026-03-06 | Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts b… |
CVE-2018-25167 | High | 8.2 | 2026-03-06 | Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to execute arbitrary… |
CVE-2018-25166 | High | 8.2 | 2026-03-06 | Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25165 | High | 7.1 | 2026-03-06 | Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25164 | High | 7.5 | 2026-03-06 | EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from… |
CVE-2018-25163 | High | 8.2 | 2026-03-06 | BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25162 | Medium | 6.5 | 2026-03-06 | 2-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executable PHP files by sending multipart form… |
CVE-2018-25161 | High | 8.2 | 2026-03-06 | Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2018-25160 | Medium | 6.5 | 2026-02-27 | HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on s… |
CVE-2018-25158 | High | 8.8 | 2026-02-20 | Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder fileman… |
CVE-2018-25157 | Medium | 6.4 | 2026-02-11 | Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names du… |
CVE-2018-25132 | Medium | 6.1 | 2026-01-23 | MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thread titles. Attacker… |
CVE-2018-25116 | Medium | 6.1 | 2026-01-23 | MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malic… |
CVE-2018-25156 | Medium | 4.3 | 2025-12-24 | Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validati… |
CVE-2018-25155 | Medium | 4.3 | 2025-12-24 | Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request valida… |
CVE-2018-25154 | Critical | 9.8 | 2025-12-24 | GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exp… |
CVE-2018-25152 | Medium | 5.3 | 2025-12-24 | Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authenticatio… |
CVE-2018-25151 | Medium | 4.3 | 2025-12-24 | Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without… |
CVE-2018-25150 | Medium | 5.3 | 2025-12-24 | Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without auth… |
CVE-2018-25149 | Medium | 6.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent… |
CVE-2018-25148 | High | 8.8 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create cront… |
CVE-2018-25147 | High | 7.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these defa… |
CVE-2018-25146 | High | 8.1 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attac… |
CVE-2018-25145 | Medium | 6.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configura… |
CVE-2018-25144 | High | 8.4 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read… |
CVE-2018-25143 | High | 8.8 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. At… |
CVE-2018-25142 | Critical | 9.8 | 2025-12-24 | NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings… |
CVE-2018-25141 | High | 7.5 | 2025-12-24 | FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers… |
CVE-2018-25140 | High | 7.5 | 2025-12-24 | FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass aut… |
CVE-2018-25139 | High | 7.5 | 2025-12-24 | FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attack… |