High severity8.8NVD Advisory· Published May 30, 2026· Updated Jun 1, 2026

CVE-2018-25409

Description

SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SIM-PKH/SIM-PKHllm-fuzzy
Range: = 2.4.1

Patches

Vulnerability mechanics

References

simpkh.sourceforge.ionvd
sourceforge.net/projects/simpkh/files/latest/downloadnvd
www.exploit-db.com/exploits/45659nvd
www.vulncheck.com/advisories/sim-pkh-arbitrary-file-upload-via-aksi-pengurus-phpnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000