CVE-2018-25071

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
roxlukas	LMeve	0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6; 0.1.7; 0.1.8; 0.1.9; 0.1.10; 0.1.11; 0.1.12; 0.1.13; 0.1.14; 0.1.15; 0.1.16; 0.1.17; 0.1.18; 0.1.19

References

https://github.com/roxlukas/lmeve/commit/c25ff7fe83a2cda1fcb365b182365adc3ffae332Patch
https://github.com/roxlukas/lmeve/releases/tag/0.1.59-betaRelease Notes
https://vuldb.com/?ctiid.217610Third Party Advisory
https://vuldb.com/?id.217610Permissions Required, Third Party Advisory
https://github.com/roxlukas/lmeve/commit/c25ff7fe83a2cda1fcb365b182365adc3ffae332Patch
https://github.com/roxlukas/lmeve/releases/tag/0.1.59-betaRelease Notes
https://vuldb.com/?ctiid.217610Third Party Advisory
https://vuldb.com/?id.217610Permissions Required, Third Party Advisory

Timeline

Published: Jan 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-250729.8A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The m CVE-2018-250736.1A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the func CVE-2018-250747.5A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validato CVE-2018-250759.8A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFun CVE-2018-250769.8A vulnerability classified as critical was found in Events Extension on BigTree. Affected by this vulnerability is the function getRandomFea CVE-2018-250777.5A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of CVE-2018-250787.8man-db before 2.8.5 on Gentoo allows local users (with access to the man user account) to gain root privileges because /usr/bin/mandb is exe CVE-2018-250797.5A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown function CVE-2018-250806.1A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType CVE-2018-250817.5Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have be CVE-2018-250829.8A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The CVE-2018-250839.8The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.