What’s Vulnerable › Vulnerabilities

CVE-2018-11136

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-05-31 · updated 2026-06-17
• Weakness: CWE-89

Description

The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL injection (in particular, a blind time-based type).

Affected products

• Quest Kace System Management Appliance: 8.0.318

References

• https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
• https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities

Get alerted when CVE-2018-11136 or the next vulnerability affects your stack