CVE-2018-18382

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-183845.5Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the CVE-2018-183857.5Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that P CVE-2018-183863.3drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block furthe CVE-2018-183878.8playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse.CVE-2018-183889.8eScan Agent Application (MWAGENT.EXE) 4.0.2.98 in MicroWorld Technologies eScan 14.0 allows remote or local attackers to execute arbitrary c CVE-2018-183899.8Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS CVE-2018-183907.5User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183918.8User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183928.8Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183939.8Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183949.8Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-183959.8Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.