ZeroDay Findings
Sign inSign up

Findings

CVE-2018-7841

Schneider Electric U.motion Builder SQL Injection Vulnerability

Published May 22, 2019 · updated Jun 16, 2026 · schneider-electric u.motion builder

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Timeline

Detection, updates, and resolution for this record.

  1. May 22, 2019 · Catalog

    Detected

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

  2. Apr 15, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. May 6, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date May 6, 2022

Affected

  • cpe schneider-electric/u.motion builder1.3.4
  • vendor Schneider Electric U.motion Builderversion unspecified

Sources

  • CISA KEVCVE-2018-7841

    A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.

    cisa.gov
  • CVE.orgCVE-2018-7841

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-7841

    30-day exploitation probability 72.7%

    first.org
  • Exploit Database46846

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2018-7841

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References