CVE-2018-25294
CEWE Photoshow 6.3.4 Buffer Overflow Denial of Service
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 26, 2026
- Updated
- Apr 27, 2026
- Reserved
- Apr 26, 2026
Description
CEWE Photoshow 6.3.4 contains a buffer overflow vulnerability in the login dialog that allows attackers to crash the application by submitting oversized input. Attackers can inject 4000 bytes of data into the email address and password fields to trigger a denial of service condition.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
| Product | Versions |
|---|---|
CEWE PhotoshowCewe-Photoworld |
|
References
- ExploitDB-45211exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: CEWE Photoshow 6.3.4 Buffer Overflow Denial of Servicethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.