CVE-2018-18382

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...

CVE-2018-18382

Advanced HRM 1.6 is affected by CVE-2018-18382, which enables Remote Code Execution via PHP code uploaded to a .php file at the user/update-user-avatar URI, accessible through the Update Profile/Change Picture flow (user/edit-profile). The issue is tied to the specific endpoint path used for upda...

CVE-2018-18382: Unrestricted Upload of File with Dangerous Type

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...

PT-2018-14428

Name of the Vulnerable Software and Affected Versions Advanced HRM version 1.6 Description The issue allows for Remote Code Execution via PHP code in a .php file to the "user/update-user-avatar" URI. This can be accessed through an "Update Profile" "Change Picture" action, also known as...