CVE-2018-7841
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which...
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
- Record
CVE-2018-7841- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
- Record
CVE-2018-7841- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2018-19553
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
- Record
EUVD-2018-19553- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cwjr-6hc3-vpjm
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which...
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
- Record
GHSA-cwjr-6hc3-vpjm- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
CISA KEV No score
Schneider Electric U.motion Builder SQL Injection Vulnerability
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
- Record
CVE-2018-7841- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection | 2019-05-14 |
| Nuclei | Schneider Electric U.motion Builder - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7841 is a critical vulnerability (CVSS 9.8) in Schneider Electric U.motion Builder, published May 22, 2019. CISA lists it as known to be exploited, since April 15, 2022. EUVD reports exploitation since April 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.5%, the 99th percentile. No source names a fixed version.
References
packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
seclists.org/fulldisclosure/2019/May/26
schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7841
nvd.nist.gov/vuln/detail/CVE-2018-7841
github.com/advisories/GHSA-cwjr-6hc3-vpjm