CVE-2020-18019

7.5 highEPSS 1.5%

High (7.5) in xinfu oa system. EPSS 1.5% chance of exploitation in the next 30 days.

SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xinfu:oa_system

References

https://github.com/si1ence90/xinhu1.8.3_SqlInject
https://github.com/si1ence90/xinhu1.8.3_SqlInject

Check your stack JSON