What’s Vulnerable › Vulnerabilities

CVE-2018-20062: ThinkPHP "noneCms" Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 99.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-11 · updated 2026-06-17

Description

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.

Affected products

• 5None Nonecms: 1.3.0

References

• http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html
• https://github.com/nangge/noneCms/issues/21
• http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html
• https://github.com/nangge/noneCms/issues/21
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20062

Get alerted when CVE-2018-20062 or the next vulnerability affects your stack