{"id":"CVE-2018-19168","details":"Shell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi) through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted mod_name parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid session.","modified":"2026-04-11T18:20:33.092139Z","published":"2018-11-11T00:29:00.183Z","references":[{"type":"ADVISORY","url":"https://github.com/xtr4nge/FruityWifi/issues/250"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xtr4nge/fruitywifi","events":[{"introduced":"0"},{"last_affected":"17b97dd0143782d5bf2da2fcac74220994e5c0cb"}],"database_specific":{"cpe":"cpe:2.3:a:fruitywifi_project:fruitywifi:*:*:*:*:*:*:*:*","source":"CPE_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"2.4"}]}}],"versions":["v2.0","v2.1","v2.1.1","v2.1.2","v2.1.3","v2.2","v2.3","v2.4"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-19168.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}