CVE-2018-16385

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

• CWE-89

• https://github.com/top-think/framework/issues/1375Exploit, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/149288Third Party Advisory
• https://github.com/top-think/framework/issues/1375Exploit, Third Party Advisory

Published

Sep 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16379Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field…
• CVE-2018-1638IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not en…5.9
• CVE-2018-16380An issue was discovered in Ogma CMS 0.4 Beta. There is a CSR…
• CVE-2018-16381e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&ac…
• CVE-2018-16382Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in …
• CVE-2018-16384A SQL injection bypass (aka PL1 bypass) exists in OWASP ModS…7.5
• CVE-2018-16386An issue was discovered in SWIFT Alliance Web Platform 7.1.2…
• CVE-2018-16387An issue was discovered in Elefant CMS before 2.0.5. There i…
• CVE-2018-16388e107_web/js/plupload/upload.php in e107 2.1.8 allows remote …
• CVE-2018-16389e107_admin/banlist.php in e107 2.1.8 allows SQL injection vi…
• CVE-2018-1639The Report Builder of Jazz Reporting Service 5.0 through 5.0…4.3
• CVE-2018-16391Several buffer overflows when handling responses from a Musc…