# Vulnerabilities published in 2018 - [CVE-2018-25431](https://insights.sbomify.com/CVE-2018-25431/): No-Cms 1.0 SQL Injection via order_by Parameter (high 7.1) - [CVE-2018-25430](https://insights.sbomify.com/CVE-2018-25430/): Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter (high 7.1) - [CVE-2018-25429](https://insights.sbomify.com/CVE-2018-25429/): Paroiciel 11.20 SQL Injection via zProIdPro Parameter (high 7.1) - [CVE-2018-25428](https://insights.sbomify.com/CVE-2018-25428/): Paroiciel 11.20 SQL Injection via tRecIdListe Parameter (high 8.8) - [CVE-2018-25427](https://insights.sbomify.com/CVE-2018-25427/): Arm Whois 3.11 Buffer Overflow via SEH Overwrite (critical 9.3) - [CVE-2018-25426](https://insights.sbomify.com/CVE-2018-25426/): WinMTR 0.91 Denial of Service via Buffer Overflow (high 8.7) - [CVE-2018-25425](https://insights.sbomify.com/CVE-2018-25425/): Yot CMS 3.3.1 SQL Injection via aid and cid Parameters (high 8.8) - [CVE-2018-25424](https://insights.sbomify.com/CVE-2018-25424/): Gate Pass Management System 2.1 SQL Injection via login-exec.php (high 8.8) - [CVE-2018-25423](https://insights.sbomify.com/CVE-2018-25423/): Arm Whois 3.11 Denial of Service via Buffer Overflow (medium 6.9) - [CVE-2018-25422](https://insights.sbomify.com/CVE-2018-25422/): MOGG web simulator Script All Version SQL Injection via play.php (high 8.8) - [CVE-2018-25421](https://insights.sbomify.com/CVE-2018-25421/): Open STA Manager 2.3 Arbitrary File Download via Path Traversal (high 7.1) - [CVE-2018-25420](https://insights.sbomify.com/CVE-2018-25420/): AiOPMSD Final 1.0.0 SQL Injection via watch.php (high 8.8) - [CVE-2018-25419](https://insights.sbomify.com/CVE-2018-25419/): AiOPMSD Final 1.0.0 SQL Injection via genre.php (high 8.8) - [CVE-2018-25418](https://insights.sbomify.com/CVE-2018-25418/): AiOPMSD Final 1.0.0 SQL Injection via year.php (high 8.8) - [CVE-2018-25417](https://insights.sbomify.com/CVE-2018-25417/): AiOPMSD Final 1.0.0 SQL Injection via quality.php (high 8.8) - [CVE-2018-25416](https://insights.sbomify.com/CVE-2018-25416/): AiOPMSD Final 1.0.0 SQL Injection via country.php (high 8.8) - [CVE-2018-25415](https://insights.sbomify.com/CVE-2018-25415/): AiOPMSD Final 1.0.0 SQL Injection via director Parameter (high 8.8) - [CVE-2018-25414](https://insights.sbomify.com/CVE-2018-25414/): AiOPMSD Final 1.0.0 SQL Injection via actor.php (high 8.8) - [CVE-2018-25413](https://insights.sbomify.com/CVE-2018-25413/): AiOPMSD Final 1.0.0 SQL Injection via search.php (high 8.8) - [CVE-2018-25412](https://insights.sbomify.com/CVE-2018-25412/): Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php (critical 9.3) - [CVE-2018-25411](https://insights.sbomify.com/CVE-2018-25411/): MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php (high 8.8) - [CVE-2018-25410](https://insights.sbomify.com/CVE-2018-25410/): SIM-PKH 2.4.1 SQL Injection via media.php id Parameter (high 7.1) - [CVE-2018-25409](https://insights.sbomify.com/CVE-2018-25409/): SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php (high 8.7) - [CVE-2018-25408](https://insights.sbomify.com/CVE-2018-25408/): The Open ISES Project 3.30A Path Traversal Arbitrary File Download (high 8.7) - [CVE-2018-25407](https://insights.sbomify.com/CVE-2018-25407/): eNdonesia Portal 8.7 SQL Injection via mod.php (high 8.8) - [CVE-2018-25406](https://insights.sbomify.com/CVE-2018-25406/): eNdonesia Portal 8.7 SQL Injection via mod.php (high 8.8) - [CVE-2018-25405](https://insights.sbomify.com/CVE-2018-25405/): eNdonesia Portal 8.7 SQL Injection via mod.php (high 8.8) - [CVE-2018-25404](https://insights.sbomify.com/CVE-2018-25404/): The Open ISES Project 3.30A SQL Injection via add_facnote.php (high 8.8) - [CVE-2018-25403](https://insights.sbomify.com/CVE-2018-25403/): The Open ISES Project 3.30A SQL Injection via city_graph.php (high 8.8) - [CVE-2018-25402](https://insights.sbomify.com/CVE-2018-25402/): The Open ISES Project 3.30A SQL Injection via inc_types_graph.php (high 8.8) - [CVE-2018-25401](https://insights.sbomify.com/CVE-2018-25401/): The Open ISES Project 3.30A SQL Injection via sever_graph.php (high 8.8) - [CVE-2018-25400](https://insights.sbomify.com/CVE-2018-25400/): The Open ISES Project 3.30A SQL Injection via form_post.php (high 8.8) - [CVE-2018-25399](https://insights.sbomify.com/CVE-2018-25399/): The Open ISES Project 3.30A SQL Injection via nearby.php (high 8.8) - [CVE-2018-25398](https://insights.sbomify.com/CVE-2018-25398/): The Open ISES Project 3.30A SQL Injection via main.php (high 8.8) - [CVE-2018-25397](https://insights.sbomify.com/CVE-2018-25397/): PHP-SHOP 1.0 Cross-Site Request Forgery via users.php (medium 6.9) - [CVE-2018-25396](https://insights.sbomify.com/CVE-2018-25396/): Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm (high 8.7) - [CVE-2018-25395](https://insights.sbomify.com/CVE-2018-25395/): Kados R10 GreenBee SQL Injection via update_feature.php (high 8.8) - [CVE-2018-25394](https://insights.sbomify.com/CVE-2018-25394/): Kados R10 GreenBee SQL Injection via update_release.php (high 8.8) - [CVE-2018-25393](https://insights.sbomify.com/CVE-2018-25393/): Navigate CMS 2.8.5 Path Traversal via navigate_download.php (high 7.1) - [CVE-2018-25392](https://insights.sbomify.com/CVE-2018-25392/): MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter (high 7.1) - [CVE-2018-25391](https://insights.sbomify.com/CVE-2018-25391/): HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion (high 8.7) - [CVE-2018-25390](https://insights.sbomify.com/CVE-2018-25390/): HaPe PKH 1.1 SQL Injection via desa Parameter (high 8.8) - [CVE-2018-25389](https://insights.sbomify.com/CVE-2018-25389/): HaPe PKH 1.1 SQL Injection via nama_kelompok Parameter (high 8.8) - [CVE-2018-25388](https://insights.sbomify.com/CVE-2018-25388/): HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php (high 8.7) - [CVE-2018-25387](https://insights.sbomify.com/CVE-2018-25387/): HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php (medium 6.9) - [CVE-2018-25386](https://insights.sbomify.com/CVE-2018-25386/): HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php (high 8.8) - [CVE-2018-25385](https://insights.sbomify.com/CVE-2018-25385/): E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai (high 8.8) - [CVE-2018-25384](https://insights.sbomify.com/CVE-2018-25384/): Wikidforum 2.20 Cross-Site Scripting via reply_text Parameter (medium 5.1) - [CVE-2018-25383](https://insights.sbomify.com/CVE-2018-25383/): Free MP3 CD Ripper 2.8 Buffer Overflow SEH DEP Bypass (high 8.6) - [CVE-2018-25382](https://insights.sbomify.com/CVE-2018-25382/): Zechat 1.5 SQL Injection via uname Parameter (high 8.8) - [CVE-2018-25381](https://insights.sbomify.com/CVE-2018-25381/): Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parameters (high 7.1) - [CVE-2018-25380](https://insights.sbomify.com/CVE-2018-25380/): Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameters (high 7.1) - [CVE-2018-25379](https://insights.sbomify.com/CVE-2018-25379/): Collectric CMU 1.0 SQL Injection via lang Parameter (high 8.8) - [CVE-2018-25378](https://insights.sbomify.com/CVE-2018-25378/): Notebook Pro 2.0 Denial of Service via Notebook Name Field (medium 6.9) - [CVE-2018-25377](https://insights.sbomify.com/CVE-2018-25377/): Flash Slideshow Maker Professional 5.20 Buffer Overflow SEH (high 8.6) - [CVE-2018-25376](https://insights.sbomify.com/CVE-2018-25376/): Socusoft 3GP Photo Slideshow 8.05 Buffer Overflow SEH (high 8.6) - [CVE-2018-25375](https://insights.sbomify.com/CVE-2018-25375/): SocuSoft iPod Photo Slideshow 8.05 Buffer Overflow SEH (high 8.6) - [CVE-2018-25374](https://insights.sbomify.com/CVE-2018-25374/): Softneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal (high 8.7) - [CVE-2018-25373](https://insights.sbomify.com/CVE-2018-25373/): DVD Photo Slideshow Professional 8.07 Buffer Overflow SEH (high 8.6) - [CVE-2018-25372](https://insights.sbomify.com/CVE-2018-25372/): MedDream PACS Server Premium 6.7.1.1 SQL Injection via email (high 8.8) - [CVE-2018-25371](https://insights.sbomify.com/CVE-2018-25371/): mooSocial Store Plugin 2.6 SQL Injection via product parameter (high 8.8) - [CVE-2018-25370](https://insights.sbomify.com/CVE-2018-25370/): Admidio 3.3.5 Cross-Site Request Forgery via roles_function.php (medium 6.9) - [CVE-2018-25369](https://insights.sbomify.com/CVE-2018-25369/): Visual Ping 0.8.0.0 Buffer Overflow Denial of Service (medium 6.9) - [CVE-2018-25368](https://insights.sbomify.com/CVE-2018-25368/): Nord VPN 6.14.31 Denial of Service via Password Field (high 8.7) - [CVE-2018-25367](https://insights.sbomify.com/CVE-2018-25367/): NASA openVSP 3.16.1 Denial of Service via Buffer Overflow (medium 6.9) - [CVE-2018-25366](https://insights.sbomify.com/CVE-2018-25366/): CuteFTP 5.0 XP Buffer Overflow via Site Manager Label Field (high 8.6) - [CVE-2018-25365](https://insights.sbomify.com/CVE-2018-25365/): PCViewer vt1000 Directory Traversal via GET Request (high 8.7) - [CVE-2018-25364](https://insights.sbomify.com/CVE-2018-25364/): Twitter-Clone 1 SQL Injection via search.php (high 8.8) - [CVE-2018-25363](https://insights.sbomify.com/CVE-2018-25363/): Twitter-Clone 1 Cross-Site Request Forgery via tweetdel.php (medium 5.3) - [CVE-2018-25362](https://insights.sbomify.com/CVE-2018-25362/): Twitter-Clone 1 SQL Injection via follow.php (high 8.8) - [CVE-2018-25361](https://insights.sbomify.com/CVE-2018-25361/): Soroush IM Desktop App 0.17.0 Authentication Bypass via Database Injection (high 7.0) - [CVE-2018-25360](https://insights.sbomify.com/CVE-2018-25360/): AgataSoft Auto PingMaster 1.5 Buffer Overflow SEH (high 8.6) - [CVE-2018-25359](https://insights.sbomify.com/CVE-2018-25359/): Splinterware System Scheduler Pro 5.12 Privilege Escalation (high 8.6) - [CVE-2018-25358](https://insights.sbomify.com/CVE-2018-25358/): D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi (high 8.7) - [CVE-2018-25357](https://insights.sbomify.com/CVE-2018-25357/): Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php (critical 9.3) - [CVE-2018-25356](https://insights.sbomify.com/CVE-2018-25356/): SIPp 3.6 Local Buffer Overflow via Command-line Arguments (high 8.6) - [CVE-2018-25355](https://insights.sbomify.com/CVE-2018-25355/): Audiograbber 1.83 Local Buffer Overflow via SEH (high 8.6) - [CVE-2018-25354](https://insights.sbomify.com/CVE-2018-25354/): Joomla Component jomres 9.11.2 Cross-Site Request Forgery (medium 5.3) - [CVE-2018-25353](https://insights.sbomify.com/CVE-2018-25353/): Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload (high 8.7) - [CVE-2018-25352](https://insights.sbomify.com/CVE-2018-25352/): WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id (high 7.1) - [CVE-2018-25351](https://insights.sbomify.com/CVE-2018-25351/): Joomla! Component EkRishta 2.10 SQL Injection via username (high 8.8) - [CVE-2018-25350](https://insights.sbomify.com/CVE-2018-25350/): userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php (critical 9.3) - [CVE-2018-25349](https://insights.sbomify.com/CVE-2018-25349/): userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header (medium 5.1) - [CVE-2018-25348](https://insights.sbomify.com/CVE-2018-25348/): Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail (high 8.8) - [CVE-2018-25347](https://insights.sbomify.com/CVE-2018-25347/): WordPress Contact Form Maker Plugin 1.12.20 SQL Injection (high 7.1) - [CVE-2018-25346](https://insights.sbomify.com/CVE-2018-25346/): WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php (high 7.1) - [CVE-2018-25345](https://insights.sbomify.com/CVE-2018-25345/): 10-Strike Network Scanner 3.0 Local Buffer Overflow SEH (high 8.6) - [CVE-2018-25344](https://insights.sbomify.com/CVE-2018-25344/): 10-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH (high 8.6) - [CVE-2018-25343](https://insights.sbomify.com/CVE-2018-25343/): Smartshop 1 Cross-Site Request Forgery via editprofile.php (medium 5.3) - [CVE-2018-25342](https://insights.sbomify.com/CVE-2018-25342/): Smartshop 1 SQL Injection via search.php (high 8.8) - [CVE-2018-25341](https://insights.sbomify.com/CVE-2018-25341/): Smartshop 1 SQL Injection via product.php id Parameter (high 8.8) - [CVE-2018-25340](https://insights.sbomify.com/CVE-2018-25340/): Smartshop 1 SQL Injection via category.php (high 8.8) - [CVE-2018-25339](https://insights.sbomify.com/CVE-2018-25339/): Zechat 1.5 SQL Injection via v parameter (time-based blind) (high 8.8) - [CVE-2018-25338](https://insights.sbomify.com/CVE-2018-25338/): Zechat 1.5 SQL Injection via hashtag parameter (high 8.8) - [CVE-2018-25337](https://insights.sbomify.com/CVE-2018-25337/): Joomla JoomOCShop 1.0 Cross-Site Request Forgery (medium 5.3) - [CVE-2018-25336](https://insights.sbomify.com/CVE-2018-25336/): jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery (medium 6.9) - [CVE-2018-25335](https://insights.sbomify.com/CVE-2018-25335/): WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload (critical 9.3) - [CVE-2018-25334](https://insights.sbomify.com/CVE-2018-25334/): Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter (medium 5.3) - [CVE-2018-25333](https://insights.sbomify.com/CVE-2018-25333/): Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection (high 8.8) - [CVE-2018-25332](https://insights.sbomify.com/CVE-2018-25332/): GitBucket 4.23.1 Unauthenticated Remote Code Execution (critical 9.3) --- From sbomify Insights: https://insights.sbomify.com/years/2018/page/54/