CVE-2018-5749

PoC —

CVSS 3.0

9.8 critical

EPSS

2%p84

Published

Jan 23, 2018 (Jan 23, 2018)

Modified

Jun 17, 2026

Description

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

Vendors: premium minecraft servers list project minecraft servers list lite project
Products: premium minecraft servers list, minecraft servers list lite
Weakness: CWE-434
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.