CVE-2018-12263

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-122648.8Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea CVE-2018-122658.8Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basCVE-2018-122666.1system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.CVE-2018-122689.8acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injectionCVE-2018-12277.5Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse softwareCVE-2018-122705.4In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick CVE-2018-122716.4An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows autheCVE-2018-122726.1xowl/request.php in Ximdex 4.0 has XSS via the content parameter.CVE-2018-122736.1The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.CVE-2018-12296.1Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user CVE-2018-122906.1The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.CVE-2018-122917.5The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events fe
CVE-2018-12263: High severity, CVSS 8.8 | Vulnix