CVE-2018-19897

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-198988.8ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users v CVE-2018-19905.3IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a s CVE-2018-199014.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.CVE-2018-199024.8No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.CVE-2018-199036.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.CVE-2018-199046.1Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.CVE-2018-199055.4HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.CVE-2018-199065.4Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.CVE-2018-199078.8A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by CVE-2018-199088.8An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used CVE-2018-19912.7IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying s CVE-2018-199117.5FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/sy