CVE-2018-1000882

WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.

• CWE-22

• http://bugs.webidsupport.com/view.php?id=646Issue Tracking, Release Notes, Vendor Advisory
• https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7fPatch
• https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txtExploit, Third Party Advisory
• http://bugs.webidsupport.com/view.php?id=646Issue Tracking, Release Notes, Vendor Advisory
• https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7fPatch
• https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txtExploit, Third Party Advisory

Published

Dec 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000876binutils version 2.32 and earlier contains a Integer Overflo…7.8
• CVE-2018-1000877libarchive version commit 416694915449219d505531b1096384f323…8.8
• CVE-2018-1000878libarchive version commit 416694915449219d505531b1096384f323…8.8
• CVE-2018-1000879libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5…6.5
• CVE-2018-1000880libarchive version commit 9693801580c0cf7c70e862d305270a16b5…6.5
• CVE-2018-1000881Traccar Traccar Server version 4.0 and earlier contains a CW…
• CVE-2018-1000883Elixir Plug Plug version All contains a Header Injection vul…
• CVE-2018-1000884Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6a…
• CVE-2018-1000885PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7b…
• CVE-2018-1000886nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vul…
• CVE-2018-1000887Peel shopping peel-shopping_9_1_0 version contains a Cross S…
• CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-50…