CVE-2018-13350

CRITICAL EXPLOITED

TerraMaster TOS 3.1.03 - SQL Injection via Event Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-13350 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.1666
EPSS Percentile 96.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2025-07-21
CWE
CWE-89
Status published
Products (1)
terra-master/terramaster_operating_system 3.1.03
Published Nov 27, 2018
Tracked Since Feb 18, 2026