CVE-2018-9850

PoC —

CVSS 3.0

7.5 high

EPSS

2%p78

Published

Apr 8, 2018 (Apr 8, 2018)

Modified

Jun 17, 2026

Description

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request.

Vendors: gxlcms
Products: gxlcms qy
Weakness: CWE-22
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news0 stories

No ingested article mentions this CVE yet.