CVE-2018-19895

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

ThinkCMF X2.2.2 has SQL Injection via the function edit_post() in NavController.class.php and is exploitable with the manager privilege via the parentid parameter in a nav action.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-198967.2ThinkCMF X2.2.2 has SQL Injection via the function delete() in SlideController.class.php and is exploitable with the manager privilege via t CVE-2018-198977.2ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privil CVE-2018-198988.8ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users v CVE-2018-19905.3IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a s CVE-2018-199014.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.CVE-2018-199024.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.CVE-2018-199036.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.CVE-2018-199046.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.CVE-2018-199055.4HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.CVE-2018-199065.4Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.CVE-2018-199078.8A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by CVE-2018-199088.8An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used