# Vulnerabilities published in 2018


- [CVE-2018-25231](https://insights.sbomify.com/CVE-2018-25231/): HeidiSQL 9.5.0.5196 Denial of Service via Preferences (medium 6.9)
- [CVE-2018-25230](https://insights.sbomify.com/CVE-2018-25230/): Free IP Switcher 3.1 Denial of Service via Computer Name (medium 6.8)
- [CVE-2018-25229](https://insights.sbomify.com/CVE-2018-25229/): BulletProof FTP Server 2019.0.0.50 Denial of Service via SMTP (medium 6.8)
- [CVE-2018-25228](https://insights.sbomify.com/CVE-2018-25228/): NetSetMan 4.7.1 Workgroup Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25227](https://insights.sbomify.com/CVE-2018-25227/): Valentina Studio 9.0.4 Denial of Service via Host Parameter (medium 6.9)
- [CVE-2018-25226](https://insights.sbomify.com/CVE-2018-25226/): FTPShell Server 6.83 Denial of Service via Account Name (medium 6.9)
- [CVE-2018-25225](https://insights.sbomify.com/CVE-2018-25225/): SIPP 3.3 Stack-Based Buffer Overflow via Configuration File (high 8.6)
- [CVE-2018-25224](https://insights.sbomify.com/CVE-2018-25224/): PMS 0.42 Stack-Based Buffer Overflow via Configuration File (high 8.6)
- [CVE-2018-25223](https://insights.sbomify.com/CVE-2018-25223/): Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution (critical 9.3)
- [CVE-2018-25222](https://insights.sbomify.com/CVE-2018-25222/): SC v7.16 Stack-Based Buffer Overflow Remote Code Execution (high 8.6)
- [CVE-2018-25221](https://insights.sbomify.com/CVE-2018-25221/): EChat Server 3.1 Buffer Overflow via chat.ghp username Parameter (critical 9.3)
- [CVE-2018-25220](https://insights.sbomify.com/CVE-2018-25220/): Bochs 2.6-5 Buffer Overflow Remote Code Execution (critical 9.3)
- [CVE-2018-25219](https://insights.sbomify.com/CVE-2018-25219/): PassFab Excel Password Recovery 8.3.1 SEH Buffer Overflow (high 8.6)
- [CVE-2018-25218](https://insights.sbomify.com/CVE-2018-25218/): PassFab RAR Password Recovery 9.3.2 SEH Buffer Overflow (high 8.6)
- [CVE-2018-25217](https://insights.sbomify.com/CVE-2018-25217/): PDF Explorer 1.5.66.2 Structured Exception Handler Local Code Execution (high 8.6)
- [CVE-2018-25216](https://insights.sbomify.com/CVE-2018-25216/): AnyBurn 4.3 Denial of Service Local Buffer Overflow (medium 6.9)
- [CVE-2018-25215](https://insights.sbomify.com/CVE-2018-25215/): Excel Password Recovery Professional 8.2.0.0 Local Buffer Overflow DoS (medium 6.8)
- [CVE-2018-25214](https://insights.sbomify.com/CVE-2018-25214/): MegaPing Local Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2018-25213](https://insights.sbomify.com/CVE-2018-25213/): Nsauditor 3.0.28.0 Local SEH Buffer Overflow (high 8.6)
- [CVE-2018-25212](https://insights.sbomify.com/CVE-2018-25212/): Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEH (high 8.6)
- [CVE-2018-25211](https://insights.sbomify.com/CVE-2018-25211/): Allok Video Splitter 3.1.1217 Buffer Overflow via License Name (high 8.5)
- [CVE-2018-25210](https://insights.sbomify.com/CVE-2018-25210/): WebOfisi E-Ticaret 4.0 SQL Injection via urun Parameter (high 8.8)
- [CVE-2018-25209](https://insights.sbomify.com/CVE-2018-25209/): OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter (high 8.8)
- [CVE-2018-25208](https://insights.sbomify.com/CVE-2018-25208/): qdPM 9.1 SQL Injection via filter_by Parameters (high 8.8)
- [CVE-2018-25207](https://insights.sbomify.com/CVE-2018-25207/): Online Quiz Maker 1.0 SQL Injection via catid Parameter (high 7.1)
- [CVE-2018-25206](https://insights.sbomify.com/CVE-2018-25206/): KomSeo Cart 1.3 SQL Injection via edit.php (high 8.8)
- [CVE-2018-25205](https://insights.sbomify.com/CVE-2018-25205/): ASP.NET jVideo Kit 1.0 SQL Injection via query Parameter (high 8.8)
- [CVE-2018-25204](https://insights.sbomify.com/CVE-2018-25204/): Library CMS 1.0 SQL Injection via admin login (high 8.8)
- [CVE-2018-25203](https://insights.sbomify.com/CVE-2018-25203/): Online Store System CMS 1.0 SQL Injection via clientaccess (high 8.8)
- [CVE-2018-25202](https://insights.sbomify.com/CVE-2018-25202/): SAT CFDI 3.3 SQL Injection via signIn endpoint (high 8.8)
- [CVE-2018-25201](https://insights.sbomify.com/CVE-2018-25201/): School Management System CMS 1.0 Admin Login SQL Injection (high 7.1)
- [CVE-2018-25200](https://insights.sbomify.com/CVE-2018-25200/): OOP CMS BLOG 1.0 Cross-Site Request Forgery via addUser.php (medium 6.9)
- [CVE-2018-25199](https://insights.sbomify.com/CVE-2018-25199/): OOP CMS BLOG 1.0 SQL Injection via search parameter (high 8.8)
- [CVE-2018-25198](https://insights.sbomify.com/CVE-2018-25198/): eToolz 3.4.8.0 Denial of Service via Buffer Overflow (medium 6.9)
- [CVE-2018-25197](https://insights.sbomify.com/CVE-2018-25197/): PlayJoom 0.10.1 SQL Injection via catid Parameter (high 8.8)
- [CVE-2018-25196](https://insights.sbomify.com/CVE-2018-25196/): ServerZilla 1.0 SQL Injection via email Parameter (high 8.8)
- [CVE-2018-25195](https://insights.sbomify.com/CVE-2018-25195/): Wecodex Hotel CMS 1.0 SQL Injection via Admin Login (high 8.8)
- [CVE-2018-25194](https://insights.sbomify.com/CVE-2018-25194/): Nominas 0.27 SQL Injection via username Parameter (high 8.8)
- [CVE-2018-25193](https://insights.sbomify.com/CVE-2018-25193/): Mongoose Web Server 6.9 Denial of Service via Socket Connection (high 8.7)
- [CVE-2018-25192](https://insights.sbomify.com/CVE-2018-25192/): GPS Tracking System 2.12 SQL Injection via username Parameter (high 8.8)
- [CVE-2018-25191](https://insights.sbomify.com/CVE-2018-25191/): Facturation System 1.0 SQL Injection via editar_producto.php (high 7.1)
- [CVE-2018-25190](https://insights.sbomify.com/CVE-2018-25190/): Easyndexer 1.0 Cross-Site Request Forgery via createuser.php (medium 6.9)
- [CVE-2018-25189](https://insights.sbomify.com/CVE-2018-25189/): Data Center Audit 2.6.2 SQL Injection via username Parameter (high 8.8)
- [CVE-2018-25188](https://insights.sbomify.com/CVE-2018-25188/): Webiness Inventory 2.3 SQL Injection via WsModelGrid.php (high 8.8)
- [CVE-2018-25187](https://insights.sbomify.com/CVE-2018-25187/): Tina4 Stack 1.0.3 SQL Injection and Database File Download (high 8.8)
- [CVE-2018-25186](https://insights.sbomify.com/CVE-2018-25186/): Tina4 Stack 1.0.3 Cross-Site Request Forgery via profile (medium 6.9)
- [CVE-2018-25185](https://insights.sbomify.com/CVE-2018-25185/): Wecodex Restaurant CMS 1.0 SQL Injection via Login (high 8.8)
- [CVE-2018-25184](https://insights.sbomify.com/CVE-2018-25184/): Surreal ToDo 0.6.1.2 Local File Inclusion via index.php (medium 6.9)
- [CVE-2018-25183](https://insights.sbomify.com/CVE-2018-25183/): Shipping System CMS 1.0 SQL Injection via admin login (high 8.8)
- [CVE-2018-25182](https://insights.sbomify.com/CVE-2018-25182/): Silurus Classifieds Script 2.0 SQL Injection via wcategory.php (high 8.8)
- [CVE-2018-25181](https://insights.sbomify.com/CVE-2018-25181/): Musicco 2.0.0 Arbitrary Directory Download via Path Traversal (high 8.7)
- [CVE-2018-25180](https://insights.sbomify.com/CVE-2018-25180/): Maitra 1.7.2 SQL Injection and Database File Download (high 7.1)
- [CVE-2018-25179](https://insights.sbomify.com/CVE-2018-25179/): Gumbo CMS 0.99 SQL Injection via settings endpoint (high 8.8)
- [CVE-2018-25178](https://insights.sbomify.com/CVE-2018-25178/): Easyndexer 1.0 Arbitrary File Download via showtif.php (high 8.7)
- [CVE-2018-25177](https://insights.sbomify.com/CVE-2018-25177/): Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php (medium 6.9)
- [CVE-2018-25176](https://insights.sbomify.com/CVE-2018-25176/): Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload (high 8.8)
- [CVE-2018-25175](https://insights.sbomify.com/CVE-2018-25175/): Alienor Web Libre 2.0 SQL Injection via index.php (high 8.8)
- [CVE-2018-25174](https://insights.sbomify.com/CVE-2018-25174/): ABC ERP 0.6.4 Cross-Site Request Forgery via _configurar_perfil.php (medium 6.9)
- [CVE-2018-25173](https://insights.sbomify.com/CVE-2018-25173/): Rmedia SMS 1.0 SQL Injection via editgrp.php (high 8.8)
- [CVE-2018-25172](https://insights.sbomify.com/CVE-2018-25172/): Pedidos 1.0 SQL Injection via load_proveedores.php (high 8.8)
- [CVE-2018-25171](https://insights.sbomify.com/CVE-2018-25171/): EdTv 2 SQL Injection via id Parameter (high 8.8)
- [CVE-2018-25170](https://insights.sbomify.com/CVE-2018-25170/): DoceboLMS 1.2 SQL Injection via lesson.php (high 8.8)
- [CVE-2018-25169](https://insights.sbomify.com/CVE-2018-25169/): AMPPS 2.7 Denial of Service via Malformed Socket Connection (high 8.7)
- [CVE-2018-25168](https://insights.sbomify.com/CVE-2018-25168/): Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin (medium 5.3)
- [CVE-2018-25167](https://insights.sbomify.com/CVE-2018-25167/): Net-Billetterie 2.9 SQL Injection via login.inc.php (high 8.8)
- [CVE-2018-25166](https://insights.sbomify.com/CVE-2018-25166/): Meneame English Pligg 5.8 SQL Injection via search Parameter (high 8.8)
- [CVE-2018-25165](https://insights.sbomify.com/CVE-2018-25165/): Galaxy Forces MMORPG 0.5.8 SQL Injection via ads.php (high 7.1)
- [CVE-2018-25164](https://insights.sbomify.com/CVE-2018-25164/): EverSync 0.5 Arbitrary File Download via files Directory (high 8.7)
- [CVE-2018-25163](https://insights.sbomify.com/CVE-2018-25163/): BitZoom 1.0 SQL Injection via rollno Parameter (high 8.8)
- [CVE-2018-25162](https://insights.sbomify.com/CVE-2018-25162/): 2-Plan Team 1.0.4 Arbitrary File Upload via managefile.php (high 7.1)
- [CVE-2018-25161](https://insights.sbomify.com/CVE-2018-25161/): Warranty Tracking System 11.06.3 SQL Injection via SearchCustomer.php (high 8.8)
- [CVE-2018-25160](https://insights.sbomify.com/CVE-2018-25160/): Code injection in HTTP::Session2 (medium 6.5)
- [CVE-2018-25159](https://insights.sbomify.com/CVE-2018-25159/): Epross AVCON6 OGNL Remote Code Execution via login.action (critical 9.3)
- [CVE-2018-25158](https://insights.sbomify.com/CVE-2018-25158/): Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder (high 8.7)
- [CVE-2018-25157](https://insights.sbomify.com/CVE-2018-25157/): Phraseanet 4.0.3 Stored XSS via Document Upload (medium 5.1)
- [CVE-2018-25156](https://insights.sbomify.com/CVE-2018-25156/): Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change (medium 5.1)
- [CVE-2018-25155](https://insights.sbomify.com/CVE-2018-25155/): Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change (medium 5.1)
- [CVE-2018-25154](https://insights.sbomify.com/CVE-2018-25154/): GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism (high 8.5)
- [CVE-2018-25152](https://insights.sbomify.com/CVE-2018-25152/): Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration (medium 5.1)
- [CVE-2018-25151](https://insights.sbomify.com/CVE-2018-25151/): Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration (medium 5.1)
- [CVE-2018-25150](https://insights.sbomify.com/CVE-2018-25150/): Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration (medium 5.1)
- [CVE-2018-25149](https://insights.sbomify.com/CVE-2018-25149/): Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface (medium 5.1)
- [CVE-2018-25148](https://insights.sbomify.com/CVE-2018-25148/): Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface (high 8.7)
- [CVE-2018-25147](https://insights.sbomify.com/CVE-2018-25147/): Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass (critical 9.3)
- [CVE-2018-25146](https://insights.sbomify.com/CVE-2018-25146/): Microhard Systems IPn4G 1.1.0 Service Control Denial of Service (high 7.1)
- [CVE-2018-25145](https://insights.sbomify.com/CVE-2018-25145/): Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download (high 7.1)
- [CVE-2018-25144](https://insights.sbomify.com/CVE-2018-25144/): Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor (high 8.7)
- [CVE-2018-25143](https://insights.sbomify.com/CVE-2018-25143/): Microhard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service (high 8.7)
- [CVE-2018-25142](https://insights.sbomify.com/CVE-2018-25142/): NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection (high 7.1)
- [CVE-2018-25141](https://insights.sbomify.com/CVE-2018-25141/): FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure (high 8.7)
- [CVE-2018-25140](https://insights.sbomify.com/CVE-2018-25140/): FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation (critical 9.3)
- [CVE-2018-25139](https://insights.sbomify.com/CVE-2018-25139/): FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure (high 8.7)
- [CVE-2018-25138](https://insights.sbomify.com/CVE-2018-25138/): FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass (critical 9.3)
- [CVE-2018-25137](https://insights.sbomify.com/CVE-2018-25137/): FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure (high 8.7)
- [CVE-2018-25136](https://insights.sbomify.com/CVE-2018-25136/): FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure (high 8.7)
- [CVE-2018-25135](https://insights.sbomify.com/CVE-2018-25135/): Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import (critical 9.3)
- [CVE-2018-25134](https://insights.sbomify.com/CVE-2018-25134/): Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi (critical 9.3)
- [CVE-2018-25133](https://insights.sbomify.com/CVE-2018-25133/): Synaccess netBooter NP-0801DU 7.4 Cross-Site Request Forgery via Admin Interface (medium 5.1)
- [CVE-2018-25132](https://insights.sbomify.com/CVE-2018-25132/): MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting (medium 5.1)
- [CVE-2018-25131](https://insights.sbomify.com/CVE-2018-25131/): Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Stored XSS via Config Upload (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2018/page/56/