Etherpad Lite before 1.6.4 is exploitable for admin access.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-9845.json"