CVE-2018-9113

Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.

• CWE-94

• https://github.com/CDCgov/MicrobeTRACE/releases/tag/v0.1.12Third Party Advisory
• https://github.com/CDCgov/MicrobeTrace/commit/e60c5fefb1b4740d42d99b634d3d3c4e66290f01
• https://github.com/wshepherd0010/advisories/blob/master/CVE-2018-9113.mdExploit, Third Party Advisory
• https://github.com/CDCgov/MicrobeTRACE/releases/tag/v0.1.12Third Party Advisory
• https://github.com/CDCgov/MicrobeTrace/commit/e60c5fefb1b4740d42d99b634d3d3c4e66290f01
• https://github.com/wshepherd0010/advisories/blob/master/CVE-2018-9113.mdExploit, Third Party Advisory

Published

Apr 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9107CSV Injection (aka Excel Macro Injection or Formula Injectio…
• CVE-2018-9108CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 a…
• CVE-2018-9109Studio 42 elFinder before 2.1.36 has a directory traversal v…9.1
• CVE-2018-9110Studio 42 elFinder before 2.1.37 has a directory traversal v…9.1
• CVE-2018-9111Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC…
• CVE-2018-9112A low privileged admin account with a weak default password …
• CVE-2018-9115Systematic SitaWare 6.4 SP2 does not validate input from oth…
• CVE-2018-9116An XXE vulnerability within WireMock before 2.16.0 allows a …
• CVE-2018-9117WireMock before 2.16.0 contains a vulnerability that allows …
• CVE-2018-9118exports/download.php in the 99 Robots WP Background Takeover…
• CVE-2018-9119An attacker with physical access to a BrilliantTS FUZE card …
• CVE-2018-9120In Crea8social 2018.2, there is Stored Cross-Site Scripting …