CVE-2018-19127

9.8 criticalEPSS 21%

Critical (9.8) in phpcms phpcms. EPSS 21% chance of exploitation in the next 30 days.

A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 21% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-11-01)
CWE: CWE-94
Published: 2018-11-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpcms:phpcms

References

https://github.com/ab1gale/phpcms-2008-CVE-2018-19127
https://github.com/ab1gale/phpcms-2008-CVE-2018-19127

Check your stack JSON