ZeroDay Findings
Sign inSign up

Findings

CVE-2018-7841

Schneider Electric U.motion Builder SQL Injection Vulnerability

Published May 22, 2019 · updated Jun 16, 2026 · schneider-electric u.motion builder

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 22, 2019 · Catalog

    Detected

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

  2. Apr 15, 2022 · CISA KEV

    Known exploited

    The impacted product is end-of-life and should be disconnected if still in use.

  3. May 6, 2022 · CISA KEV

    Remediation due

    The impacted product is end-of-life and should be disconnected if still in use.

  4. Jun 16, 2026 · Catalog

    Updated

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Required action

The impacted product is end-of-life and should be disconnected if still in use.

CISA due date May 6, 2022

Affected

  • cpe schneider-electric/u.motion builder1.3.4
  • vendor Schneider Electric U.motion Builderversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2018-7841

    A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2018-7841

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2018-7841

    30-day exploitation probability 72.7%

    first.org
  • Exploit DatabasePublic exploit reference46846

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDVulnerability recordCVE-2018-7841

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References