CVE-2018-19135

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-191366.1DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.CVE-2018-191376.1DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.CVE-2018-191388.8WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.CVE-2018-191395.5An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.CVE-2018-19145.4IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2018-191414.8Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL be CVE-2018-191424.8Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.CVE-2018-191436.5Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete f CVE-2018-191456.1An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.CVE-2018-191464.8Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT CVE-2018-191483.7Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Speci CVE-2018-191496.5Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachmen