CVE-2018-25111

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-277

Affected software

VendorProductVersions
django-helpdesk Projectdjango-helpdesk< 1.0.0

References

Timeline

Published
May 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-251127.5An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creatinCVE-2018-251138.7An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allCVE-2018-251149.3A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and misCVE-2018-251159.8Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contaCVE-2018-251166.1MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. AttackeCVE-2018-251179.3VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain comproCVE-2018-2511810.0GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgiCVE-2018-251196.1Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validationCVE-2018-251209.8D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail CVE-2018-251215.4Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validaCVE-2018-251228.8Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handlerCVE-2018-251237.8Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/script
CVE-2018-25111: Medium severity, CVSS 4.4 | Vulnix