CVE-2018-15818

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with web server privileges by sending a malicious request to admin-ajax.php.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-158197.5EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.CVE-2018-158206.1EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.CVE-2018-158227.5The flv_write_packet function in libavformat/flvenc.c in FFmpeg through 2.8 does not check for an empty audio packet, leading to an assertio CVE-2018-15835.4IBM StoredIQ 7.6 could allow an authenticated attacker to bypass certain security restrictions. By sending a specially-crafted request, an a CVE-2018-158328.8upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required CVE-2018-158334.3In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of CVE-2018-158345.5In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a cr CVE-2018-158357.5Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983.CVE-2018-158367.5In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padd CVE-2018-158399.8D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.CVE-2018-15845.4IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2018-158407.5TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by