CVE-2018-19893

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-198947.2ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manCVE-2018-198957.2ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via CVE-2018-198967.2ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via tCVE-2018-198977.2ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilCVE-2018-198988.8ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users vCVE-2018-19905.3IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a sCVE-2018-199014.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.CVE-2018-199024.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.CVE-2018-199036.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.CVE-2018-199046.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.CVE-2018-199055.4HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.CVE-2018-199065.4Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.