CVE-2018-19196

2018-11-1205:00:00

mitre

www.cve.org

xiaocms

remote code execution

vulnerability

20141229

AI Score

9.8

Confidence

High

EPSS

0.033

Percentile

91.5%

JSON

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.