CVE-2018-18399: Jco Karma

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.

Affected products

• Jco Karma: version 6.0.0 only

Published 2018-12-20. Last modified 2026-06-17.