CVE-2018-20727: Nedi

High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days.

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.

Affected products

• Nedi Nedi: up to and including 1.7c

Published 2019-01-17. Last modified 2026-06-17.