CVE-2018-19196

An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.

• CWE-94

• https://github.com/AvaterXXX/XiaoCms/blob/master/GETSHELL.mdExploit, Third Party Advisory
• https://www.patec.cn/newsshow.php?cid=24&id=136Broken Link, Third Party Advisory
• https://github.com/AvaterXXX/XiaoCms/blob/master/GETSHELL.mdExploit, Third Party Advisory
• https://www.patec.cn/newsshow.php?cid=24&id=136Broken Link, Third Party Advisory

Published

Nov 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19190The Amazon PAYFORT payfort-php-SDK payment gateway SDK throu…
• CVE-2018-19191Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/inde…
• CVE-2018-19192An issue was discovered in XiaoCms 20141229. admin/index.php…
• CVE-2018-19193An issue was discovered in XiaoCms 20141229. There is XSS vi…
• CVE-2018-19194An issue was discovered in XiaoCms 20141229. /admin/index.ph…
• CVE-2018-19195An issue was discovered in XiaoCms 20141229. There is XSS re…
• CVE-2018-19197An issue was discovered in XiaoCms 20141229. admin\controlle…
• CVE-2018-19198An issue was discovered in uriparser before 0.9.0. UriQuery.…
• CVE-2018-19199An issue was discovered in uriparser before 0.9.0. UriQuery.…
• CVE-2018-1920IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable t…7.1
• CVE-2018-19200An issue was discovered in uriparser before 0.9.0. UriCommon…
• CVE-2018-19201A reflected XSS vulnerability in the ModCP Profile Editor in…