CVE-2018-5203

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Devpia	DEXTUploadX5	DEXTUploadX5 Between 1.0.0.0 and 2.2.0.0

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30122Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30122Third Party Advisory

Timeline

Published: Dec 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-52049.8ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute CVE-2018-52057.5When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string.CVE-2018-52069.8When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer.CVE-2018-52077.5When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string.CVE-2018-52089.8In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings.CVE-2018-52108.1On Samsung mobile devices with N(7.x) software and Exynos chipsets, attackers can conduct a Trustlet stack overflow attack for arbitrary TEE CVE-2018-52119.8PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist.CVE-2018-52125.4The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit CVE-2018-52135.4The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action CVE-2018-52145.4The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.CVE-2018-52155.4Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.CVE-2018-52165.4Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.