CVE-2019-6127

PoC —

CVSS 3.0

7.2 high

EPSS

2%p73

Published

Jan 11, 2019 (Jan 11, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table[] SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename.

Vendors: xiaocms
Products: xiaocms
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.