Skip to content

CVE-2018-19181 statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory tr...

HighCVSS 7.5 EPSS 1.4%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file.

Affected products

ProductAffected versionsFixed in
yunucms = 1.1.5 No fix listed

References

  • github.com exploit issue-tracking third-party-advisory