Critical severity9.8NVD Advisory· Published Apr 25, 2019· Updated Jun 17, 2026

CVE-2018-18286

Description

SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mitel/Cmg Suite3 versions
cpe:2.3:a:mitel:cmg_suite:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mitel:cmg_suite:*:*:*:*:*:*:*:*range: <=8.4
- cpe:2.3:a:mitel:cmg_suite:8.4:sp2:*:*:*:*:*:*
- (no CPE)range: <=8.4 SP2
CMG Suite/CMG Suitellm-create
Range: <=8.4 SP2

Patches

Vulnerability mechanics

References

www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdfnvdVendor Advisory
www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000