VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 17, 2018· Updated Jun 17, 2026

CVE-2018-14334

CVE-2018-14334

Description

manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the $errm value, and does not otherwise alter the flow of control. Consequently, one can upload and execute a .php file, a similar issue to CVE-2018-8766.

Affected products

2
  • Joyplus/Joyplus CMSinferred2 versions
    = 1.6.0+ 1 more
    • (no CPE)range: = 1.6.0
    • (no CPE)range: =1.6.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.