CVE-2018-10757

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dukereborn/cmum/commit/c89158ec646c4e8e95587b650f6fd86b502ff8b5Patch, Third Party Advisory
https://packetstormsecurity.com/files/147501/cspmysqlum231-sql.txtExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44589/Exploit, Third Party Advisory, VDB Entry
https://github.com/dukereborn/cmum/commit/c89158ec646c4e8e95587b650f6fd86b502ff8b5Patch, Third Party Advisory
https://packetstormsecurity.com/files/147501/cspmysqlum231-sql.txtExploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44589/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-107586.5The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles.CVE-2018-107599.8PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbit CVE-2018-107608.8Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbi CVE-2018-107634.8Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields CVE-2018-107676.5There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0 CVE-2018-107686.5There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5. A crafted CVE-2018-107697.5The transferProxy and approveProxy functions of a smart contract implementation for SmartMesh (SMT), an Ethereum ERC20 token, allow attacker CVE-2018-10777.5Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.CVE-2018-107709.8download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the p CVE-2018-107719.8Stack-based buffer overflow in the get_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of servi CVE-2018-107726.5The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (application crash) or CVE-2018-107736.5NULL pointer deference in the addsn function in serialno.c in libbibcore.a in bibutils through 6.2 allows remote attackers to cause a denial