VULNERABILITY INTELLIGENCE

CVE-2018-19654

CVSS score7.5 HIGH
EPSS probability0.92%
CISA KEVNot currently listed
Published2018-11-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a duplicate username, as demonstrated by use of the test%c2 string when a test account already exists.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references