1.0.7

DATE	CVE	VULNERABILITY TITLE	RISK
2022-10-06	CVE-2022-40895	Information Exposure Through Discrepancy vulnerability in Nedi 1.0.7 In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. network low complexity nedi CWE-203 critical	9.1
2019-01-17	CVE-2018-20731	Cross-site Scripting vulnerability in Nedi A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php. network low complexity nedi CWE-79	6.1
2019-01-17	CVE-2018-20730	SQL Injection vulnerability in Nedi A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component. network low complexity nedi CWE-89	7.5
2019-01-17	CVE-2018-20729	Cross-site Scripting vulnerability in Nedi A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php. network low complexity nedi CWE-79	6.1
2019-01-17	CVE-2018-20728	Cross-Site Request Forgery (CSRF) vulnerability in Nedi A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php. network low complexity nedi CWE-352	8.8
2019-01-17	CVE-2018-20727	OS Command Injection vulnerability in Nedi Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php. network low complexity nedi CWE-78	8.8