CVE-2018-13850: Icanstudioz Firebase Push Notification On IOS / Fcm + Advance Admin Panel

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter.

Affected products

• Icanstudioz Firebase Push Notification On IOS / Fcm + Advance Admin Panel: up to and including 2017-10-26

Published 2018-07-10. Last modified 2026-06-17.