What’s Vulnerable › Vulnerabilities

CVE-2018-10235

• Severity: high (CVSS 7.2 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-04-19 · updated 2026-06-17
• Weakness: CWE-94

Description

POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache['setting']['ucssocfg'] in diy\module\member\models\Member_model.php and write this code into the api/ucsso/config.php file.

Affected products

• Poscms: 3.2.10

References

• https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-10.md
• https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-10.md

Get alerted when CVE-2018-10235 or the next vulnerability affects your stack