CVE-2018-14956

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sensitive information.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/149571/CMS-ISWEB-3.5.3-SQL-Injection.htmlThird Party Advisory, VDB Entry
https://cxsecurity.com/issue/WLB-2018090249Issue Tracking, Third Party Advisory
https://imgur.com/a/buXJJKCExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/150516Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/149571/CMS-ISWEB-3.5.3-SQL-Injection.htmlThird Party Advisory, VDB Entry
https://cxsecurity.com/issue/WLB-2018090249Issue Tracking, Third Party Advisory
https://imgur.com/a/buXJJKCExploit, Third Party Advisory

Timeline

Published: Sep 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-149579.8CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_docume CVE-2018-149588.8An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.CVE-2018-149598.8An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.CVE-2018-14965.4IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2018-149608.8Xiao5uCompany 1.7 has CSRF via admin/Admin.asp.CVE-2018-149619.8dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.CVE-2018-149625.4zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.CVE-2018-149638.8zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.CVE-2018-149645.4An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.CVE-2018-149658.8An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.CVE-2018-149668.8An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.CVE-2018-149678.8An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.