cve.bz

CVE-2018-19274

7.2 highEPSS 5.2%

High (7.2). EPSS 5.2% chance of exploitation in the next 30 days.

Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.

Severity

CVSS 3.1

7.2 high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
5.2% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWEs
CWE-502, CWE-1321
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON