CVE-2018-25333

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.

Score

CVSS 4.0 8.8 High

Status

Awaiting Analysis - disclosure@vulncheck.com

Published

2026-05-17

Last modified

2026-05-26

Weaknesses

CWE-89

Affected products

• N149 Wind Turbine Web Server (Nordex-online)

References

• http://www.nordex-online.com
• https://www.exploit-db.com/exploits/44684
• https://www.vulncheck.com/advisories/nordex-n149-wind-turbine-web-server-sql-injection