CVE-2018-9845

Etherpad Lite before 1.6.4 is exploitable for admin access.

• CWE-178

• https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.mdThird Party Advisory
• https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511bPatch, Third Party Advisory
• https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.mdThird Party Advisory
• https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511bPatch, Third Party Advisory

Published

Apr 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9839An issue was discovered in MantisBT through 1.3.14, and 2.0.…
• CVE-2018-9840The Open Whisper Signal app before 2.23.2 for iOS allows phy…
• CVE-2018-9841The export function in libavfilter/vf_signature.c in FFmpeg …
• CVE-2018-9842CyberArk Password Vault before 9.7 allows remote attackers t…
• CVE-2018-9843The REST API in CyberArk Password Vault Web Access before 9.…
• CVE-2018-9844The Iptanus WordPress File Upload plugin before 4.3.4 for Wo…
• CVE-2018-9846In Roundcube from versions 1.2.0 to 1.3.5, with the archive …
• CVE-2018-9847In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Actio…
• CVE-2018-9848In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Actio…
• CVE-2018-9849Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x…
• CVE-2018-9850In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.clas…
• CVE-2018-9851In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class…