CVE-2018-13415

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attackers can use this vulnerability to: (1) Access arbitrary files from the filesystem with the same permission as the user account running Plex, (2) Initiate SMB connections to capture a NetNTLM challenge/response and crack to cleartext password, or (3) Initiate SMB connections to relay a NetNTLM challenge/response and achieve Remote Command Execution in Windows domains.

• CWE-611

• http://seclists.org/fulldisclosure/2018/Aug/1Exploit, Mailing List, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/45146/Exploit, Technical Description, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Aug/1Exploit, Mailing List, Technical Description, Third Party Advisory
• https://www.exploit-db.com/exploits/45146/Exploit, Technical Description, Third Party Advisory, VDB Entry

Published

Aug 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-13407A CSRF issue was discovered in Jirafeau before 3.4.1. The "d…
• CVE-2018-13408An issue was discovered in Jirafeau before 3.4.1. The "searc…
• CVE-2018-13409An issue was discovered in Jirafeau before 3.4.1. The "searc…
• CVE-2018-13410Info-ZIP Zip 3.0, when the -T and -TT command-line options a…
• CVE-2018-13411An issue was discovered in Zoho ManageEngine Desktop Central…
• CVE-2018-13412An issue was discovered in the Self Service Portal in Zoho M…
• CVE-2018-13416In Universal Media Server (UMS) 7.1.0, the XML parsing engin…
• CVE-2018-13417In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine fo…
• CVE-2018-13418System command injection in ajaxdata.php in TerraMaster TOS …
• CVE-2018-13419An issue has been found in libsndfile 1.0.28. There is a mem…
• CVE-2018-1342A Vulnerability exists on Admin Console where an attacker ca…
• CVE-2018-13420Google gperftools 2.7 has a memory leak in malloc_extension.…