CVE-2018-19135

ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admin (or any user with the file upload capability). With this vulnerability, one can automatically upload files (by default, it allows html, pdf, xml, zip, and many other file types). A file can be accessed publicly under the "/assets/files" directory.

• CWE-352

• https://github.com/ClipperCMS/ClipperCMS/issues/494Exploit, Issue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/45839/Exploit, Third Party Advisory, VDB Entry
• https://github.com/ClipperCMS/ClipperCMS/issues/494Exploit, Issue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/45839/Exploit, Third Party Advisory, VDB Entry

Published

Nov 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1913IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.…5.4
• CVE-2018-19130In Libav 12.3, there is an invalid memory access in vc1_deco…
• CVE-2018-19131Squid before 4.4 has XSS via a crafted X.509 certificate dur…
• CVE-2018-19132Squid before 4.4, when SNMP is enabled, allows a denial of s…
• CVE-2018-19133In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyo…
• CVE-2018-19134In Artifex Ghostscript through 9.25, the setpattern operator…
• CVE-2018-19136DomainMOD through 4.11.01 has XSS via the assets/edit/regist…
• CVE-2018-19137DomainMOD through 4.11.01 has XSS via the assets/edit/ip-add…
• CVE-2018-19138WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.ht…
• CVE-2018-19139An issue has been found in JasPer 2.0.14. There is a memory …
• CVE-2018-1914IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6…5.4
• CVE-2018-19141Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.…