CVE-2018-10260

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 1, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-102658.8An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/usersCVE-2018-102668.8BEESCMS 4.0 has a CSRF vulnerability to add an administrator account via the admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user URI.CVE-2018-102678.8WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI.CVE-2018-102685.4An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\api\controller\User.php avatar parameter.CVE-2018-10277.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-10288.8A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "MiCVE-2018-102839.8CliqueMania loja virtual 14 has SQL Injection via the patch/remote.php id parameter in a recomendar action.CVE-2018-102849.8Adaltech G-Ticket v70 EME104 has SQL Injection via the mobile-loja/mensagem.asp eve_cod parameter.CVE-2018-102859.8The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID,CVE-2018-102868.8The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL databasCVE-2018-102895.5In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote adversary could leverage this CVE-2018-10297.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "
CVE-2018-10260: High severity, CVSS 8.8 | Vulnix