CVE-2018-19410

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Nov 21, 2018
Last modified
Jun 17, 2026
Added to CISA KEV
Feb 4, 2025
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-194118.8PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write accoCVE-2018-194134.3A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as vCVE-2018-194146.1Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via thCVE-2018-194159.8Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameterCVE-2018-194167.8An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demoCVE-2018-1941710.0An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages witCVE-2018-194187.8Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control.CVE-2018-194203.8In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such asCVE-2018-194213.8In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upCVE-2018-194227.2/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess fiCVE-2018-194237.2Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.CVE-2018-194247.2ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files.