CVE-2018-7308

A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users to add/delete/modify any files in any hosting account.

• CWE-352

• http://www.andmp.com/2018/02/advisory-assigned-cve-2018-7308-csrf.htmlThird Party Advisory
• https://github.com/DanWin/hosting/issues/18Third Party Advisory
• http://www.andmp.com/2018/02/advisory-assigned-cve-2018-7308-csrf.htmlThird Party Advisory
• https://github.com/DanWin/hosting/issues/18Third Party Advisory

Published

Feb 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7301eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC …
• CVE-2018-7302Tiki 17.1 allows upload of a .PNG file that actually has SVG…
• CVE-2018-7303The Calendar component in Tiki 17.1 allows HTML injection.
• CVE-2018-7304Tiki 17.1 does not validate user input for special character…
• CVE-2018-7305MyBB 1.8.14 is not checking for a valid CSRF token, leading …
• CVE-2018-7307The Auth0 Auth0.js library before 9.3 has CSRF because it mi…
• CVE-2018-7311PrivateVPN 2.0.31 for macOS suffers from a root privilege es…8.8
• CVE-2018-7312SQL Injection exists in the Alexandria Book Library 3.1.2 co…
• CVE-2018-7313SQL Injection exists in the CW Tags 2.0.6 component for Joom…
• CVE-2018-7314SQL Injection exists in the PrayerCenter 3.0.2 component for…
• CVE-2018-7315SQL Injection exists in the Ek Rishta 2.9 component for Joom…
• CVE-2018-7316Arbitrary File Upload exists in the Proclaim 9.1.1 component…