CVE-2018-19197

2018-11-1205:00:00

mitre

www.cve.org

xiaocms 20141229

arbitrary directory deletion

directory traversal

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=…/ directory traversal.

References

github.com/AvaterXXX/XiaoCms/blob/master/DIR_DEL.md

www.patec.cn/newsshow.php?cid=24&id=136