CVE-2018-6906: Rainmachine Web Application

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API.

Affected products

• Rainmachine Rainmachine Web Application: affected versions not specified

Published 2018-11-01. Last modified 2026-06-17.