CVE-2013-2738

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

minidlna has SQL Injection that may allow retrieval of arbitrary files

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.htmlBroken Link
http://media.blackhat.com/bh-us-12/Briefings/Cutlip/BH_US_12_Cutlip_SQL_Exploitation_WP.pdfExploit, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2738Third Party Advisory
https://www.securityfocus.com/archive/1/527299/30/0Third Party Advisory, VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2013-07/0100.htmlBroken Link
http://media.blackhat.com/bh-us-12/Briefings/Cutlip/BH_US_12_Cutlip_SQL_Exploitation_WP.pdfExploit, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2738Third Party Advisory
https://www.securityfocus.com/archive/1/527299/30/0Third Party Advisory, VDB Entry

Timeline

Published: Nov 1, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-27399.8MiniDLNA has heap-based buffer overflow CVE-2013-27417.5importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enab CVE-2013-27427.5importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after comple CVE-2013-27437.5importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentica CVE-2013-27445.0importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpi CVE-2013-27459.8An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0 CVE-2013-27476.5The password reset feature in Courion Access Risk Management Suite Version 8 Update 9 allows remote authenticated users to bypass intended I CVE-2013-27489.8Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.CVE-2013-27504.3Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to CVE-2013-275110.0Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4 CVE-2013-27526.8Cross-site request forgery (CSRF) vulnerability in frontview/lib/np_handler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before CVE-2013-27546.8Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authenticati