ACTIVELY EXPLOITED
CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability
| Vendor | Schneider Electric |
|---|---|
| Product | U.motion Builder |
| Actively exploited | Yes |
| Added to CISA KEV | 15 Apr 2022 |
| CISA federal deadline | 6 May 2022 |
| Weakness (CWE) | CWE-89 |
Required action (CISA's text)
The impacted product is end-of-life and should be disconnected if still in use.
Description (NVD)
A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.