VYPR
← All advisories
High severity7.2OSV Advisory· Published Dec 6, 2018· Updated Jun 17, 2026

CVE-2018-19897

CVE-2018-19897

Description

ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Thinkcmf/CmfxOSV2 versions
    X2.2.0, X2.2.1, X2.2.2, …+ 1 more
    • (no CPE)range: X2.2.0, X2.2.1, X2.2.2, …
    • (no CPE)range: = X2.2.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.