CVE-2018-9160

SiCKRAGE Discloses Plaintext Credentials

9.8 CriticalPublic exploitFix available

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

75.6%Up 53.8 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: CVE-2018-9160
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-522
Updated: 2026-11-02

CVE List No score

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: CVE-2018-9160
Updated: 2026-11-02

EUVDEUVD-2018-0136 No score

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: EUVD-2018-0136
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jrcv-3c5h-rh3q 9.8

SiCKRAGE Discloses Plaintext Credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: GHSA-jrcv-3c5h-rh3q
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-522
Updated: 2026-11-02

OSV 9.8

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: CVE-2018-9160
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-jrcv-3c5h-rh3q 9.8

SiCKRAGE Discloses Plaintext Credentials

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: GHSA-jrcv-3c5h-rh3q
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-522
Updated: 2026-11-02

OSVPYSEC-2018-101 No score

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

Record: PYSEC-2018-101
Updated: 2026-11-02

Affected products

sickrage

Affected packages

Affected packages
Package	Affected	Fixed
`sickrage` PyPI	before 2018.03.09-1	2018.03.09-1
`sickrage` PyPI	before 2018.03.09-1, plus listed versions 10.0.010.0.0.dev1010.0.0.dev1110.0.0.dev1210.0.0.dev13 Show 45 moreShow less 10.0.0.dev1410.0.0.dev1510.0.0.dev1610.0.0.dev1710.0.0.dev1810.0.0.dev1910.0.0.dev2010.0.0.dev2110.0.0.dev2210.0.0.dev2310.0.0.dev2410.0.0.dev2510.0.0.dev2610.0.0.dev2710.0.0.dev2810.0.0.dev2910.0.0.dev310.0.0.dev3010.0.0.dev3110.0.0.dev3310.0.0.dev3410.0.0.dev3510.0.0.dev410.0.0.dev510.0.0.dev610.0.0.dev710.0.0.dev810.0.0.dev910.0.110.0.1.dev110.0.1010.0.10.dev110.0.10.dev210.0.1110.0.11.dev110.0.11.dev210.0.1210.0.12.dev110.0.12.dev210.0.12.dev310.0.12.dev410.0.12.dev510.0.12.dev610.0.12.dev710.0.12.dev8	2018.03.09-1
`sickrage` PyPI	before 9.3.2, plus listed versions 6.0.476.0.486.0.496.0.506.0.51 Show 45 moreShow less 6.0.526.0.536.0.546.0.557.0.07.0.17.0.107.0.127.0.167.0.177.0.187.0.197.0.27.0.207.0.217.0.227.0.237.0.37.0.57.0.67.0.77.0.87.0.98.0.08.0.18.0.118.0.28.0.38.0.48.0.58.0.68.0.78.0.98.1.08.1.18.1.28.1.38.1.48.1.58.1.78.1.88.1.98.2.08.2.18.2.2	9.3.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response	2018-04-26
Metasploit	HTTP SickRage Password Leak	2018-03-08
PoC in GitHub	mechanico/sickrageWTF	2018-04-26

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-9160 is a critical vulnerability (CVSS 9.8) in Sickrage, published March 31, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.6%, the 99th percentile. Fixed in sickrage 2018.03.09-1.

References

This page doesn't list everything

Left out here: 1,452 versions. The JSON record has them.