High severity8.8NVD Advisory· Published Oct 17, 2018· Updated Jun 17, 2026

CVE-2018-18426

Description

s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.php txt parameter.

Affected products

S CMS/S CMS2 versions
cpe:2.3:a:s-cms:s-cms:3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:s-cms:s-cms:3.0:*:*:*:*:*:*:*
- (no CPE)range: <3.0

Patches

Vulnerability mechanics

References

www.ttk7.cn/post-93.htmlnvdExploitThird Party Advisory
www.s-cms.cn/update.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000