← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2018-9845 · published 29 April 2018
CVE-2018-9845: Etherpad lite vulnerability
Etherpad · Etherpad Lite
Etherpad Lite before 1.6.4 is exploitable for admin access.
9.8 CVSS 3.0 Critical EPSS 13% · top 3.8% CWE-178 · CWE-178
9.8CVSS 3.0 base score, v2 7.5
13%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD
Description
Etherpad Lite before 1.6.4 is exploitable for admin access.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md | Third Party Advisory |
| https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b | PatchThird Party Advisory |
| https://github.com/ether/etherpad-lite/blob/develop/CHANGELOG.md | Third Party Advisory |
| https://github.com/ether/etherpad-lite/commit/ffe24c3dd93efc73e0cbf924db9a0cc40be9511b | PatchThird Party Advisory |
Track CVE-2018-9845 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
6.1CVE-2018-6834Etherpad lite cross-site scripting vulnerabilitystatic/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.EPSS 0.88%9.8CVE-2020-12812FortiOS SSL VPN two-factor authentication bypass via username case changeFortiOS SSL VPN fails to enforce the second authentication factor (FortiToken) when a user alters the letter case of their username. Because the user…KEVEPSS 49%analysed
Source: NIST National Vulnerability Database (record CVE-2018-9845), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
