CVE-2018-11523

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-115257.8The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.CVE-2018-115267.8The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-115278.8An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackerCVE-2018-115289.8WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.CVE-2018-115298.0VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafCVE-2018-11537.4Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in tCVE-2018-115319.8Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.CVE-2018-115326.1An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject fCVE-2018-115359.8An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable uCVE-2018-115369.8md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.CVE-2018-115376.5Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of thCVE-2018-115388.8servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSR
CVE-2018-11523: Critical severity, CVSS 9.8 | Vulnix