VYPR
← All advisories
High severity7.5NVD Advisory· Published Dec 26, 2018· Updated Jun 17, 2026

CVE-2018-20478

CVE-2018-20478

Description

An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value.

Affected products

2
  • S CMS/S CMSllm-fuzzy2 versions
    <=1.0+ 1 more
    • (no CPE)range: <=1.0
    • cpe:2.3:a:s-cms:s-cms:1.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.