Critical severity9.8NVD Advisory· Published Nov 12, 2018· Updated Jun 17, 2026

CVE-2018-19196

Description

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.

Affected products

Xiaocms/Xiaocmsinferred2 versions
= 20141229+ 1 more
- (no CPE)range: = 20141229
- (no CPE)range: =20141229

Patches

Vulnerability mechanics

References

github.com/AvaterXXX/XiaoCms/blob/master/GETSHELL.mdnvdExploitThird Party Advisory
www.patec.cn/newsshow.phpnvdBroken LinkThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000