CVE-2018-9206

PoC ×4—

CVSS 3.1

9.8 critical

EPSS

97%p100

Published

Oct 11, 2018 (Oct 11, 2018)

Modified

Aug 12, 2026

Description

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0

Vendors: jquery file upload project
Products: jquery file upload
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (97.3%)

In the news3 stories

Crooks leverages .htaccess injector on Joomla and WordPress sites for malicious redirects

Security AffairsMay 27, 12:39 UTC · May 27, 2019Exploit / PoC CVE-2018-9206

60

Thousands of applications affected by a zero

Security AffairsOct 20, 08:38 UTC · Oct 20, 2018Exploit / PoC in the wildCVE-2018-9206

60

KashmirBlack, a new botnet in the threat landscape that rapidly grows

Security AffairsOct 26, 17:09 UTC · Oct 26, 2020Malware CVE-2017-9841 CVE-2018-9206 CVE-2019-9194+4 CVEs

47