{"advisories":[{"id":"EUVD-2018-3540","source":"euvd","title":"The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3540"}],"cve":"CVE-2018-11511","epss":{"score":0.11266},"mitre":{"cpes":[],"created":"2018-08-16T20:00:00+00:00","description":"The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2018/11xxx/CVE-2018-11511.json","references":["http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html","https://www.exploit-db.com/exploits/45200/"],"title":null,"updated":"2024-08-05T08:10:14.640000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:asustor:asustor_data_master:3.1.0:*:*:*:*:*:*:*"],"created":"2018-08-16T20:29:01.673000+00:00","description":"The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.","metrics":{"cvssV2_0":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cvssV3_0":{"score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2018/CVE-2018-11511.json","references":["http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html","https://www.exploit-db.com/exploits/45200/"],"title":null,"updated":"2026-06-17T01:36:05.153000+00:00","vendors":["asustor","asustor$PRODUCT$asustor_data_master"],"weaknesses":["CWE-89"]},"opencve":{"changes":[],"cpes":{"data":["cpe:2.3:a:asustor:asustor_data_master:3.1.0:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2018-08-16T20:00:00+00:00","provider":"mitre"},"description":{"data":"The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope' parameter via a photo-gallery/api/album/tree_lists/ URI.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"provider":"nvd"},"cvssV3_0":{"data":{"score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.11266},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["http://packetstormsecurity.com/files/148919/ASUSTOR-NAS-ADM-3.1.0-Remote-Command-Execution-SQL-Injection.html","https://www.exploit-db.com/exploits/45200/"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2024-11-21T03:43:31.380000+00:00","provider":"nvd"},"vendors":{"data":["asustor","asustor$PRODUCT$asustor_data_master"],"providers":["nvd"]},"weaknesses":{"data":["CWE-89"],"providers":["nvd"]}}}