CVE-2018-13025

2018-06-2917:00:00

mitre

www.cve.org

yxcms 1.4.7

photocontroller.php

deletion vulnerability

remote attackers

arbitrary files

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

41.9%

JSON

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.

References

github.com/zhaoheng521/yxcms/blob/master/Any%20file%20deletion