Read the docs
TI-2018-15298 Aliases CVE-2018-25071GHSA-rqjj-7ph3-x9gc

roxlukas LMeve proxy.php insert_log sql injection

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.00724 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
roxlukasLMeve0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6; 0.1.7; 0.1.8; 0.1.9; 0.1.10; 0.1.11; 0.1.12; 0.1.13; 0.1.14; 0.1.15; 0.1.16; 0.1.17; 0.1.18; 0.1.19; 0.1.20; 0.1.21; 0.1.22; 0.1.23; 0.1.24; 0.1.25; 0.1.26; 0.1.27; 0.1.28; 0.1.29; 0.1.30; 0.1.31; 0.1.32; 0.1.33; 0.1.34; 0.1.35; 0.1.36; 0.1.37; 0.1.38; 0.1.39; 0.1.40; 0.1.41; 0.1.42; 0.1.43; 0.1.44; 0.1.45; 0.1.46; 0.1.47; 0.1.48; 0.1.49; 0.1.50; 0.1.51; 0.1.52; 0.1.53; 0.1.54; 0.1.55; 0.1.56; 0.1.57; 0.1.58—No fix listedCNA
  • LMeve Vendorroxlukas Affected 0.1.0; 0.1.1; 0.1.2; 0.1.3; 0.1.4; 0.1.5; 0.1.6; 0.1.7; 0.1.8; 0.1.9; 0.1.10; 0.1.11; 0.1.12; 0.1.13; 0.1.14; 0.1.15; 0.1.16; 0.1.17; 0.1.18; 0.1.19; 0.1.20; 0.1.21; 0.1.22; 0.1.23; 0.1.24; 0.1.25; 0.1.26; 0.1.27; 0.1.28; 0.1.29; 0.1.30; 0.1.31; 0.1.32; 0.1.33; 0.1.34; 0.1.35; 0.1.36; 0.1.37; 0.1.38; 0.1.39; 0.1.40; 0.1.41; 0.1.42; 0.1.43; 0.1.44; 0.1.45; 0.1.46; 0.1.47; 0.1.48; 0.1.49; 0.1.50; 0.1.51; 0.1.52; 0.1.53; 0.1.54; 0.1.55; 0.1.56; 0.1.57; 0.1.58 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:roxlukas:lmeve:*:*:*:*:*:*:*:*up to 0.1.58Vulnerableroxlukas
  • cpe:2.3:a:roxlukas:lmeve:*:*:*:*:*:*:*:* Versions up to 0.1.58 Vulnerable ·roxlukas

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25071
  2. 2026-10-03 Alias added: GHSA-rqjj-7ph3-x9gc

References

Patch 2

  • TI-2021-03104 roxlukas LMeve Login Page sql injection CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences