CVE-2018-6860

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-68615.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.CVE-2018-68625.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.CVE-2018-68639.8SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter.CVE-2018-68645.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.CVE-2018-68665.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.CVE-2018-68675.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.CVE-2018-68685.4Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.CVE-2018-68696.5In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. RemoteCVE-2018-68706.1Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature.CVE-2018-68719.8LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which useCVE-2018-68725.5The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows CVE-2018-68739.8The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
CVE-2018-6860: High severity, CVSS 8.8 | Vulnix