{"id":"CVE-2018-17936","aliases":["EUVD-2018-9677","GHSA-h329-mq35-h7hv"],"status":"published","title":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can...","description":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15312,"percentile":0.96793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2018-11-27T20:29:00.893Z","modified":"2026-06-17T01:46:34Z","exploits":[{"source":"metasploit","id":"exploit/windows/nuuo/nuuo_cms_fu","title":"Nuuo Central Management Server Authenticated Arbitrary File Upload","type":"exploit","platform":"Windows","date":"2018-10-11","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/nuuo/nuuo_cms_fu"}],"products":[{"vendor":"nuuo","product":"nuuo cms"},{"vendor":"nuuo","product":"nuuo_cms"}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17936"},{"url":"https://github.com/advisories/GHSA-h329-mq35-h7hv"}],"sources":{"cve":[{"id":"CVE-2018-17936","description":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.","status":"published","published":"2018-11-27T21:00:00Z","modified":"2024-08-05T11:01:14.717Z","cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2018-9677","description":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.","status":"published","published":"2018-11-27T21:00:00Z","modified":"2024-08-05T11:01:14Z","updated_at":"2026-11-03T02:39:37.172177Z"}],"ghsa":[{"id":"GHSA-h329-mq35-h7hv","title":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can...","description":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.","status":"published","published":"2022-05-13T01:33:44Z","modified":"2023-02-01T05:08:36Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2018-17936","description":"NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution.","status":"published","published":"2018-11-27T20:29:00.893Z","modified":"2026-06-17T01:46:34.01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:04:48.987926Z"}]}}