CVE-2018-5987

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://exploit-db.com/exploits/44131Exploit, Third Party Advisory, VDB Entry
https://exploit-db.com/exploits/44131Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-59889.8SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.CVE-2018-59899.8SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue t CVE-2018-59909.8SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.CVE-2018-59919.8SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different v CVE-2018-59929.8SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.CVE-2018-59939.8SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.CVE-2018-59949.8SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a CVE-2018-59955.5The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address inform CVE-2018-59967.8Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory c CVE-2018-59979.8An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnera CVE-2018-59999.8An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requ CVE-2018-60009.8An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides