CVE-2018-10236

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-19 · updated 2026-06-17
Weakness: CWE-94

Description

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data['name'] with no restrictions, and this value is written to the FCPATH.$file file.

Affected products

Poscms: 3.2.18

References

https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-18.md
https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-18.md

Get alerted when CVE-2018-10236 or the next vulnerability affects your stack