CVE-2018-5749

install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does not sanitize input before saving database connection information in connect.php, which might allow remote attackers to execute arbitrary PHP code via the (1) database_server, (2) database_user, (3) database_password, or (4) database_name parameter.

• CWE-434

• https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/Exploit, Mitigation, Patch, Third Party Advisory
• https://www.rastating.com/minecraft-servers-list-unauthenticated-shell-upload/Exploit, Mitigation, Patch, Third Party Advisory

Published

Jan 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5743By design, BIND is intended to limit the number of TCP clien…7.5
• CVE-2018-5744A failure to free memory can occur when processing messages …7.5
• CVE-2018-5745"managed-keys" is a feature which allows a BIND resolver to …4.9
• CVE-2018-5746Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2018-5747In Long Range Zip (aka lrzip) 0.631, there is a use-after-fr…5.5
• CVE-2018-5748qemu/qemu_monitor.c in libvirt allows attackers to cause a d…
• CVE-2018-5750The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in th…
• CVE-2018-5751The backend component in Open-Xchange OX App Suite before 7.…
• CVE-2018-5752The backend component in Open-Xchange OX App Suite before 7.…
• CVE-2018-5753The frontend component in Open-Xchange OX App Suite before 7…
• CVE-2018-5754Cross-site scripting (XSS) vulnerability in the office-web c…
• CVE-2018-5755Absolute path traversal vulnerability in the readerengine co…