CVE-2018-25106

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 23, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-251077.5The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of randoCVE-2018-251087.5An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.CVE-2018-251096.4A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified aCVE-2018-251107.5Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in seCVE-2018-251114.4django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.CVE-2018-251127.5An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creatinCVE-2018-251138.7An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allCVE-2018-251149.3A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and misCVE-2018-251159.8Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contaCVE-2018-251166.1MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. AttackeCVE-2018-251179.3VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain comproCVE-2018-2511810.0GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgi
CVE-2018-25106: Medium severity, CVSS 6.3 | Vulnix