CVE-2018-19196

PoC —

CVSS 3.0

9.8 critical

EPSS

3%p88

Published

Nov 12, 2018 (Nov 12, 2018)

Modified

Jun 17, 2026

Description

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.

Vendors: xiaocms
Products: xiaocms
Weakness: CWE-94
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.3%)

In the news0 stories

No ingested article mentions this CVE yet.