CVE-2018-9205

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Robbin Zhaoavatar_uploader>= unspecified, < 7.x-1.0-beta8

References

Timeline

Published
Apr 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-92069.8Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0CVE-2018-92079.8Arbitrary file upload in jQuery Upload File <= 4.0.2CVE-2018-92089.8Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1BetaCVE-2018-92099.8Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2CVE-2018-92309.8In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore paCVE-2018-92327.8Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmCVE-2018-92337.8Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xmCVE-2018-92347.5GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in aCVE-2018-92356.1iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.CVE-2018-92365.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.CVE-2018-92375.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.CVE-2018-92386.1proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
CVE-2018-9205: High severity, CVSS 7.5 | Vulnix