CVE-2018-16604

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}").

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-166055.4D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.CVE-2018-166066.5In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstrac CVE-2018-166075.4Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbi CVE-2018-166088.8In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&acti CVE-2018-16618.8IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malic CVE-2018-166139.8An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate CVE-2018-166189.8VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. It exposes the storei CVE-2018-166196.1Sonatype Nexus Repository Manager before 3.14 allows XSS.CVE-2018-166207.5Sonatype Nexus Repository Manager before 3.14 has Incorrect Access Control.CVE-2018-166217.2Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.CVE-2018-166225.4Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web CVE-2018-166234.8Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.