CVE-2018-18626

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because del_action() in admin/model/database.class.php mishandles this parameter.

• http://str3am.me/2018/10/23/CVE_01/#moreBroken Link, Third Party Advisory, URL Repurposed
• http://str3am.me/2018/10/23/CVE_01/#moreBroken Link, Third Party Advisory, URL Repurposed

Published

Oct 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18619internal/advanced_comment_system/admin.php in Advanced Comme…
• CVE-2018-18621CommuniGate Pro 6.2 allows stored XSS via a message body in …
• CVE-2018-18622An issue was discovered in Waimai Super Cms 20150505. There …
• CVE-2018-18623Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" scree…6.1
• CVE-2018-18624Grafana 5.3.1 has XSS via a column style on the "Dashboard >…6.1
• CVE-2018-18625Grafana 5.3.1 has XSS via a link on the "Dashboard > All Pan…6.1
• CVE-2018-18628An issue was discovered in Pippo 1.11.0. The function Serial…
• CVE-2018-18629An issue was discovered in the Keybase command-line client b…
• CVE-2018-18630A vulnerability was found in McKesson Cardiology product 13.…7.8
• CVE-2018-18631mailboxd component in Synacor Zimbra Collaboration Suite 8.6…
• CVE-2018-18635www/guis/admin/application/controllers/UserController.php in…
• CVE-2018-18636XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via …