CVE-2018-15441

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted HTTP POST requests that contain malicious SQL statements to an affected application. A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 28, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-154427.8A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to executCVE-2018-154437.5A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a confiCVE-2018-154447.3A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gCVE-2018-154458.0A vulnerability in the web-based management interface of Cisco Energy Management Suite Software could allow an authenticated, remote attackeCVE-2018-154467.5A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulneraCVE-2018-154479.8A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote CVE-2018-154487.5A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to disCVE-2018-154496.5A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attackCVE-2018-15457.5IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attackeCVE-2018-154506.5A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files CVE-2018-154515.4A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conducCVE-2018-154526.7A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticate
CVE-2018-15441: Critical severity, CVSS 9.8 | Vulnix