CVE-2018-15529

A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin interface, to inject arbitrary commands within the filename of a system upgrade upload.

• CWE-78

• http://packetstormsecurity.com/files/149065/Mutiny-Monitoring-Appliance-Command-Injection.htmlThird Party Advisory, VDB Entry
• https://doddsecurity.com/135/remote-command-execution-on-the-monitoring-appliances/
• https://github.com/doddr/Security-Advisories/tree/master/Mutiny/CVE-2018-15529Third Party Advisory
• https://www.mutiny.com/mutiny-support/release-summary/
• http://packetstormsecurity.com/files/149065/Mutiny-Monitoring-Appliance-Command-Injection.htmlThird Party Advisory, VDB Entry
• https://doddsecurity.com/135/remote-command-execution-on-the-monitoring-appliances/
• https://github.com/doddr/Security-Advisories/tree/master/Mutiny/CVE-2018-15529Third Party Advisory
• https://www.mutiny.com/mutiny-support/release-summary/

Published

Aug 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15517The MailConnect feature on D-Link Central WiFiManager CWM-10…
• CVE-2018-15518QXmlStream in Qt 5.x before 5.11.3 has a double-free or corr…
• CVE-2018-15519Various Lexmark devices have a Buffer Overflow (issue 1 of 2…
• CVE-2018-1552IBM Robotic Process Automation with Automation Anywhere 10.0…5.5
• CVE-2018-15520Various Lexmark devices have a Buffer Overflow (issue 2 of 2…
• CVE-2018-15528Reflected Cross-Site Scripting exists in the Java System Sol…
• CVE-2018-1553IBM WebSphere Application Server Liberty prior to 18.0.0.2 c…5.3
• CVE-2018-15530Cross-site scripting (XSS) in the web interface of the Xerox…
• CVE-2018-15531JavaMelody before 1.74.0 has XXE via parseSoapMethodName in …
• CVE-2018-15532SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 al…
• CVE-2018-15533A reflected cross-site scripting vulnerability exists in Geu…
• CVE-2018-15534Geutebrueck re_porter 16 before 7.8.974.20 has a possibility…